theWRAP by TronDoc

Hunt Hypothesis

This hypothesis targets the execution of the “theWRAP” YARA signature, which identifies specific malicious code patterns or known threat artifacts associated with the TronDoc rule set. Proactively hunting for this low-severity indicator allows the SOC to detect early-stage intrusions or dormant payloads that may not yet trigger high-fidelity alerts, ensuring timely containment within the Azure Sentinel environment.

YARA Rule

rule theWRAP_by_TronDoc: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7 }
        $b = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Software Packaging and Deployment: System administrators using enterprise packaging tools like Advanced Installer, InstallShield, or WiX Toolset to create .msi or .exe wrappers for internal applications. These tools often embed scripts or use specific compression algorithms that may match the structural patterns of theWRAP.

  • Filter/Exclusion: Exclude files located in standard build directories (e.g., C:\Builds\, D:\Artifacts\) or exclude processes originating from known packaging executables (e.g., AdvancedInstaller.exe, WiX.exe).

• CI/CD Pipeline Artifact Generation: Continuous Integration servers (e.g., Jenkins, Azure DevOps, GitHub Actions) generating executable artifacts or wrapper scripts for deployment packages. The agent process (e.g., jenkins-agent.exe, vsts-agent.exe) may create temporary wrapper executables that trigger the YARA signature.

  • Filter/Exclusion: Exclude files created by processes matching *agent*.exe or *runner*.exe within the CI/CD workspace directories (e.g., C:\jenkins\workspace\, D:\azure-devops\agent\).

• Legacy Application Updaters: Older enterprise applications (e.g., Adobe Creative Suite, Oracle Java, Microsoft Office) using self-contained updater mechanisms that download and execute a wrapper installer. These updaters often reside in C:\Program Files\Common Files\ or C:\Windows\Temp\ and may exhibit theWRAP-like characteristics.

  • Filter/Exclusion: Exclude files in C:\Windows\Temp\ or C:\Program Files\Common Files\ if the parent process is a known updater service (e.g., UpdateService.exe, AdobeUpdateService.exe) and the file extension is .exe or `.