Analysis
- user interaction
yes - max time kernel
126s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 22:30
Behavioral task
behavioral1
Sample
azura.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
azura.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target azura.exe
- Size 48.5MB
- Sample260712-2exd6abv7z
- SHA256 d8b28c9264ddde46cc1199c62d7a2cc321e6b71842ab5bfce04a12c25f09f54b
- MD5 fbaebfb78a6b81367b430587566264ba
- SHA1 86015c1cb640e4b748e58fa70bdfbc5699bb8f9d
- SHA512 0642b480d43fd0a1a642e97095cea0e5fac9efe03d207aade77159d99f468fe70e124d1a8641f7e42cf51c6495235f0a86cf224dc6fa0ca81fcfed4d76c67c7b
- SSDEEP 786432:djqleQFKIX1T39wm+MPOIfBs2bmm0GvTOjSAh3DmnZRr2C3uTuflXsiJHJ+i4RX4:d8eWKI939l1OxWmvIObuzr0COww
- TLSH T1E5B7337CE042F5B4EDB2F9F1F2D4F8A0C49A29261692EA49964C4708463D336FBD425F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ azura.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion azura.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion azura.exe -
resource yara_rule behavioral2/memory/4076-0-0x0000000000400000-0x0000000005BC8000-memory.dmp themida behavioral2/memory/4076-2-0x0000000000400000-0x0000000005BC8000-memory.dmp themida behavioral2/memory/4076-1-0x0000000000400000-0x0000000005BC8000-memory.dmp themida behavioral2/memory/4076-3-0x0000000000400000-0x0000000005BC8000-memory.dmp themida behavioral2/memory/4076-5-0x0000000000400000-0x0000000005BC8000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA azura.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl svchost.exe File opened for modification C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 4076 azura.exe 4076 azura.exe 4076 azura.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language azura.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 4076 azura.exe 4076 azura.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1436 taskmgr.exe Token: SeSystemProfilePrivilege 1436 taskmgr.exe Token: SeCreateGlobalPrivilege 1436 taskmgr.exe Token: 33 1436 taskmgr.exe Token: SeIncBasePriorityPrivilege 1436 taskmgr.exe Token: SeShutdownPrivilege 5308 svchost.exe - Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe - Suspicious use of SendNotifyMessage 45 IoCs
pid Process 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe 1436 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1436 taskmgr.exe 2104 SecHealthUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\azura.exe"C:\Users\Admin\AppData\Local\Temp\azura.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4076
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5980
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1948
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:5076
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵PID:3172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:4572