Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe
Resource
win10v2004-20220812-en
General
-
Target
ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe
-
Size
1.1MB
-
MD5
93a90c1bd243c9374f56bbc305019ba5
-
SHA1
1ab2dcb3694583791b82d2503a0f2e5fe8774ef3
-
SHA256
ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf
-
SHA512
4a5a33f738ea0463c0d64c5cf88ef20c7986ed78f56705f6e65a4c8687b4532e189aaf805a457244637ed05fb8d8e929b2885d5b3519be90fa347d03534e11b3
-
SSDEEP
24576:VZxTFJ17kFTSNCdr+SzIAYqRavbkKlijox:VXTFfIRaCdaSdYsvjo
Malware Config
Signatures
-
Ardamax main executable 3 IoCs
resource yara_rule behavioral1/files/0x00070000000133e5-55.dat family_ardamax behavioral1/files/0x00070000000133e5-57.dat family_ardamax behavioral1/files/0x00070000000133e5-63.dat family_ardamax -
Executes dropped EXE 1 IoCs
pid Process 1016 MLM.exe -
Loads dropped DLL 2 IoCs
pid Process 2040 ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe 1016 MLM.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run MLM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MLM Start = "C:\\Windows\\SysWOW64\\SDIGDD\\MLM.exe" MLM.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\SDIGDD\AKV.exe ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe File created C:\Windows\SysWOW64\SDIGDD\MLM.exe ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe File opened for modification C:\Windows\SysWOW64\SDIGDD\ MLM.exe File created C:\Windows\SysWOW64\SDIGDD\MLM.004 ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe File created C:\Windows\SysWOW64\SDIGDD\MLM.001 ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe File created C:\Windows\SysWOW64\SDIGDD\MLM.002 ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 1016 MLM.exe Token: SeIncBasePriorityPrivilege 1016 MLM.exe Token: SeIncBasePriorityPrivilege 1016 MLM.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1016 MLM.exe 1016 MLM.exe 1016 MLM.exe 1016 MLM.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1016 2040 ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe 28 PID 2040 wrote to memory of 1016 2040 ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe 28 PID 2040 wrote to memory of 1016 2040 ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe 28 PID 2040 wrote to memory of 1016 2040 ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe 28 PID 1016 wrote to memory of 1692 1016 MLM.exe 29 PID 1016 wrote to memory of 1692 1016 MLM.exe 29 PID 1016 wrote to memory of 1692 1016 MLM.exe 29 PID 1016 wrote to memory of 1692 1016 MLM.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe"C:\Users\Admin\AppData\Local\Temp\ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\SDIGDD\MLM.exe"C:\Windows\system32\SDIGDD\MLM.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\SDIGDD\MLM.exe > nul3⤵PID:1692
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD51f29b1075a91b3da0ccc0b9c49eece56
SHA1048e675f087181035aedece9e7b11d065c6355cc
SHA2564f6825548b32329c3360ed9abb7c0a6809a2c2291cf0bcaac511a9fa32a6336e
SHA5127e152caf055f57f599ecc1e3a404b540b721b3315d2ba16bff6eb21f03edeb3a06ae185621e3139293612d94210f500f098bd281489ca7f336efd8b5284ee060
-
Filesize
61KB
MD531c866d8e4448c28ae63660a0521cd92
SHA10e4dcb44e3c8589688b8eacdd8cc463a920baab9
SHA256dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1
SHA5121076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839
-
Filesize
43KB
MD5093e599a1281e943ce1592f61d9591af
SHA16896810fe9b7efe4f5ae68bf280fec637e97adf5
SHA2561ac0964d97b02204f4d4ae79cd5244342f1a1798f5846e9dd7f3448d4177a009
SHA51264cb58fbf6295d15d9ee6a8a7a325e7673af7ee02e4ece8da5a95257f666566a425b348b802b78ac82e7868ba7923f85255c2c31e548618afa9706c1f88d34dc
-
Filesize
1KB
MD54c835b9bc9cfde1ba199a05fbdb031ec
SHA198029a6741be5b9a59531c34f59616fa697e8235
SHA256f72f93216830a0a02556402dfe08e2a13c154ae00f2711583a1afcb9bb538a83
SHA512c255496f8e6a102488fbdc3b502a05f826bef2da4e273548bc0eafa8947c785e7eebefdde8a67127ea31d5010036d97ef171c3657cb4e810b54c083993a1503e
-
Filesize
1.5MB
MD50aaffc12ef1b416b9276bdc3fdec9dff
SHA19f38d7cf6241d867da58f89db9ff26544314b938
SHA25642b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b
SHA512bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c
-
Filesize
1.5MB
MD50aaffc12ef1b416b9276bdc3fdec9dff
SHA19f38d7cf6241d867da58f89db9ff26544314b938
SHA25642b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b
SHA512bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c
-
Filesize
61KB
MD531c866d8e4448c28ae63660a0521cd92
SHA10e4dcb44e3c8589688b8eacdd8cc463a920baab9
SHA256dc0eaf9d62f0e40b6522d28b2e06b39ff619f9086ea7aa45fd40396a8eb61aa1
SHA5121076da7f8137a90b5d3bbbbe2b24fd9774de6adbcdfd41fd55ae90c70b9eb4bbf441732689ad25e5b3048987bfb1d63ba59d5831a04c6d84cb05bbfd2d32f839
-
Filesize
1.5MB
MD50aaffc12ef1b416b9276bdc3fdec9dff
SHA19f38d7cf6241d867da58f89db9ff26544314b938
SHA25642b33dd905c5668c2518a6a7d407fb10c303cfedeaefcd7b6e4c7cc1b891c73b
SHA512bbde0986b298c6172e7c8e3f938db9425f54cca097e280736e1ba289afd06a0b86f7cbc91f6d46458bc8e75069c12cda1cf808acf3b6c773b0661d081136ee7c