Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 17:17

General

  • Target

    ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe

  • Size

    1.1MB

  • MD5

    93a90c1bd243c9374f56bbc305019ba5

  • SHA1

    1ab2dcb3694583791b82d2503a0f2e5fe8774ef3

  • SHA256

    ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf

  • SHA512

    4a5a33f738ea0463c0d64c5cf88ef20c7986ed78f56705f6e65a4c8687b4532e189aaf805a457244637ed05fb8d8e929b2885d5b3519be90fa347d03534e11b3

  • SSDEEP

    24576:VZxTFJ17kFTSNCdr+SzIAYqRavbkKlijox:VXTFfIRaCdaSdYsvjo

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe
    "C:\Users\Admin\AppData\Local\Temp\ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\SDIGDD\MLM.exe
      "C:\Windows\system32\SDIGDD\MLM.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SDIGDD\MLM.exe > nul
        3⤵
          PID:1692

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\SDIGDD\AKV.exe

      Filesize

      456KB

      MD5

      1f29b1075a91b3da0ccc0b9c49eece56

      SHA1

      048e675f087181035aedece9e7b11d065c6355cc

      SHA256

      4f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e

      SHA512

      7e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060

    • C:\Windows\SysWOW64\SDIGDD\MLM.001

      Filesize

      61KB

      MD5

      31c866d8e4448c28ae63660a0521cd92

      SHA1

      0e4dcb44e3c8589688b8eacdd8cc463a920baab9

      SHA256

      dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1

      SHA512

      1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839

    • C:\Windows\SysWOW64\SDIGDD\MLM.002

      Filesize

      43KB

      MD5

      093e599a1281e943ce1592f61d9591af

      SHA1

      6896810fe9b7efe4f5ae68bf280fec637e97adf5

      SHA256

      1ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009

      SHA512

      64cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc

    • C:\Windows\SysWOW64\SDIGDD\MLM.004

      Filesize

      1KB

      MD5

      4c835b9bc9cfde1ba199a05fbdb031ec

      SHA1

      98029a6741be5b9a59531c34f59616fa697e8235

      SHA256

      f72f93216830a0a02556402dfe08e2a13c154ae00f2711583a1afcb9bb538a83

      SHA512

      c255496f8e6a102488fbdc3b502a05f826bef2da4e273548bc0eafa8947c785e7eebefdde8a67127ea31d5010036d97ef171c3657cb4e810b54c083993a1503e

    • C:\Windows\SysWOW64\SDIGDD\MLM.exe

      Filesize

      1.5MB

      MD5

      0aaffc12ef1b416b9276bdc3fdec9dff

      SHA1

      9f38d7cf6241d867da58f89db9ff26544314b938

      SHA256

      42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

      SHA512

      bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

    • C:\Windows\SysWOW64\SDIGDD\MLM.exe

      Filesize

      1.5MB

      MD5

      0aaffc12ef1b416b9276bdc3fdec9dff

      SHA1

      9f38d7cf6241d867da58f89db9ff26544314b938

      SHA256

      42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

      SHA512

      bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

    • \Windows\SysWOW64\SDIGDD\MLM.001

      Filesize

      61KB

      MD5

      31c866d8e4448c28ae63660a0521cd92

      SHA1

      0e4dcb44e3c8589688b8eacdd8cc463a920baab9

      SHA256

      dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1

      SHA512

      1076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839

    • \Windows\SysWOW64\SDIGDD\MLM.exe

      Filesize

      1.5MB

      MD5

      0aaffc12ef1b416b9276bdc3fdec9dff

      SHA1

      9f38d7cf6241d867da58f89db9ff26544314b938

      SHA256

      42b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b

      SHA512

      bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c

    • memory/2040-54-0x00000000760B1000-0x00000000760B3000-memory.dmp

      Filesize

      8KB