Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20/05/2024, 07:38

General

  • Target

    ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe

  • Size

    783KB

  • MD5

    e33af9e602cbb7ac3634c2608150dd18

  • SHA1

    8f6ec9bc137822bc1ddf439c35fedc3b847ce3fe

  • SHA256

    8c870eec48bc4ea1aca1f0c63c8a82aaadaf837f197708a7f0321238da8b6b75

  • SHA512

    2ae5003e64b525049535ebd5c42a9d1f6d76052cccaa623026758aabe5b1d1b5781ca91c727f3ecb9ac30b829b8ce56f11b177f220330c704915b19b37f8f418

  • SSDEEP

    12288:0E9uQlDTt8c/wtocu3HhGSrIilDhlPnRq/iI7UOvqF8dtbcZl36VBqWPH:FuqD2cYWzBGZohlE/zUD8/bgl2qW/

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe
    "C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\SysWOW64\28463\DPBJ.exe
      "C:\Windows\system32\28463\DPBJ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    97eee85d1aebf93d5d9400cb4e9c771b

    SHA1

    26fa2bf5fce2d86b891ac0741a6999bff31397de

    SHA256

    30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

    SHA512

    8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

  • C:\Windows\SysWOW64\28463\DPBJ.001

    Filesize

    492B

    MD5

    7a0f1fa20fd40c047b07379da5290f2b

    SHA1

    e0fb8305de6b661a747d849edb77d95959186fca

    SHA256

    b0ad9e9d3d51e8434cc466bec16e2b94fc2d03bab03b48ccf57db86ae8e2c9b6

    SHA512

    bb5b3138b863811a8b9dcba079ac8a2828dae73943a1cc1d107d27faca509fda9f03409db7c23d5d70b48d299146de14b656314a24b854f3ae4fdb6ef6770346

  • C:\Windows\SysWOW64\28463\DPBJ.006

    Filesize

    8KB

    MD5

    35b24c473bdcdb4411e326c6c437e8ed

    SHA1

    ec1055365bc2a66e52de2d66d24d742863c1ce3d

    SHA256

    4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

    SHA512

    32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

  • C:\Windows\SysWOW64\28463\DPBJ.007

    Filesize

    5KB

    MD5

    a8e19de6669e831956049685225058a8

    SHA1

    6d2546d49d92b18591ad4fedbc92626686e7e979

    SHA256

    34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

    SHA512

    5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

  • C:\Windows\SysWOW64\28463\DPBJ.009

    Filesize

    1.3MB

    MD5

    15559ac9054150c8475f07a95df2bae0

    SHA1

    2112d15b6fa8841fd436bbdc3965216257513b3b

    SHA256

    0e7b24f2a0a812198f1f5ebccef3d6b874504a0e35083b2203af585032b424bd

    SHA512

    44ca28ab6e67d943838714ae0bc70b83057827988f9df283670aba2dc7f8ebe25ddaaccfc5dd40d9e81b4c8dd76d8c64bc13b4d79fa9f9ccf5dd01672c576658

  • C:\Windows\SysWOW64\28463\May_20_2024__07_39_00.jpg

    Filesize

    95KB

    MD5

    d6b8611d5293f2a2fb8777735da99ef1

    SHA1

    4cd2a7904da89a21ff35bc0ee71a13c932aaed56

    SHA256

    a17453173dfceebce86da3f076338adb1570ea57e7c74ae4977933b5a93429ed

    SHA512

    9381209324a2ea1cd42ef7fbdb5f0733e425ecb9706c465b3429cd0f6eedf772ffcf3f31fdd174ef1663eb3ecbdb0a8025f55a296a29d8629eaba0ba436de21c

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    106B

    MD5

    639d75ab6799987dff4f0cf79fa70c76

    SHA1

    be2678476d07f78bb81e8813c9ee2bfff7cc7efb

    SHA256

    fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

    SHA512

    4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

  • \Users\Admin\AppData\Local\Temp\@F0E.tmp

    Filesize

    4KB

    MD5

    d73d89b1ea433724795b3d2b524f596c

    SHA1

    213514f48ece9f074266b122ee2d06e842871c8c

    SHA256

    8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

    SHA512

    8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

  • \Windows\SysWOW64\28463\DPBJ.exe

    Filesize

    646KB

    MD5

    b863a9ac3bcdcde2fd7408944d5bf976

    SHA1

    4bd106cd9aefdf2b51f91079760855e04f73f3b0

    SHA256

    0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

    SHA512

    4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

  • memory/2368-16-0x0000000002A20000-0x0000000002AFF000-memory.dmp

    Filesize

    892KB

  • memory/2628-31-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2628-40-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2628-28-0x00000000030B0000-0x00000000030B3000-memory.dmp

    Filesize

    12KB

  • memory/2628-27-0x00000000030C0000-0x00000000030C1000-memory.dmp

    Filesize

    4KB

  • memory/2628-26-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/2628-25-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/2628-24-0x0000000001E90000-0x0000000001E91000-memory.dmp

    Filesize

    4KB

  • memory/2628-23-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/2628-22-0x0000000000560000-0x0000000000561000-memory.dmp

    Filesize

    4KB

  • memory/2628-21-0x0000000000510000-0x0000000000511000-memory.dmp

    Filesize

    4KB

  • memory/2628-30-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2628-44-0x0000000003110000-0x0000000003111000-memory.dmp

    Filesize

    4KB

  • memory/2628-43-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2628-42-0x00000000030D0000-0x00000000030D1000-memory.dmp

    Filesize

    4KB

  • memory/2628-41-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2628-29-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2628-32-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2628-33-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2628-34-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2628-19-0x0000000000340000-0x000000000039A000-memory.dmp

    Filesize

    360KB

  • memory/2628-57-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2628-67-0x0000000000340000-0x000000000039A000-memory.dmp

    Filesize

    360KB

  • memory/2628-71-0x0000000003100000-0x0000000003101000-memory.dmp

    Filesize

    4KB

  • memory/2628-18-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2628-97-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2628-151-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2628-305-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2628-517-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2628-790-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB