Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
358393682ba7a3ac9e63d0b9faa15178
-
SHA1
58656237e8d2299017bdcc15b4e5afda9074bf82
-
SHA256
64c18cbee94fc9cb7a4978f908c79356433f3c6091a928654ea8555367fb0ca0
-
SHA512
1739b80728187a3584eedc426498daafed943b12bb320f86bc5a23522485f9651b72581ffec7c9d7d8270e97504f9af20311156908d1309f960eb919213fd1de
-
SSDEEP
24576:cHvZT0d//nI2VA6hX5pdoHPPuRMp4uwUTVZKXGUWikDYRBTCr8A:kBTynImBc3AM8isGoICBTCr8
Malware Config
Extracted
Protocol: ftp- Host:
ftp.drivehq.com - Port:
21 - Username:
homecomming
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0006000000018798-6.dat family_ardamax -
Executes dropped EXE 1 IoCs
pid Process 2424 MXJ.exe -
Loads dropped DLL 2 IoCs
pid Process 2704 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe 2424 MXJ.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MXJ Start = "C:\\Windows\\SysWOW64\\PLXWJW\\MXJ.exe" MXJ.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\PLXWJW\MXJ.001 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe File created C:\Windows\SysWOW64\PLXWJW\MXJ.002 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe File created C:\Windows\SysWOW64\PLXWJW\AKV.exe 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe File created C:\Windows\SysWOW64\PLXWJW\MXJ.exe 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PLXWJW\MXJ.008 MXJ.exe File created C:\Windows\SysWOW64\PLXWJW\Screen_Jul_10_2024__16_33_44.html MXJ.exe File created C:\Windows\SysWOW64\PLXWJW\MXJ.004 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe File created C:\Windows\SysWOW64\PLXWJW\MXJ.008 MXJ.exe File created C:\Windows\SysWOW64\PLXWJW\Screen_Jul_10_2024__16_33_44.jpg MXJ.exe File opened for modification C:\Windows\SysWOW64\PLXWJW\ MXJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2424 MXJ.exe Token: SeIncBasePriorityPrivilege 2424 MXJ.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2424 MXJ.exe 2424 MXJ.exe 2424 MXJ.exe 2424 MXJ.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2424 2704 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe 30 PID 2704 wrote to memory of 2424 2704 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe 30 PID 2704 wrote to memory of 2424 2704 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe 30 PID 2704 wrote to memory of 2424 2704 358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\358393682ba7a3ac9e63d0b9faa15178_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\PLXWJW\MXJ.exe"C:\Windows\system32\PLXWJW\MXJ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
461KB
MD57e335c1258740a5798c2b3eea5a97229
SHA16ce1e98ddc05a4b9e772901c9bc6caae4103267f
SHA256667ab5d791b89216a46f7dd3a1bcb9b7e5f235415a74a9678ca41cec051c462f
SHA5128c190dd139f5459a91c81871f53fc080a81c6397c68cb5b0ee195571012cc8af923b10cd77301da1816f935d36a0587d1c75126f5553005a0f50eb22d3441cb4
-
Filesize
97KB
MD5f263754210d4e4ed68225a72cb962005
SHA1907381cc058eca2988969dd5592d25d095925632
SHA256d5c75cd7b9d9e6d6c8357a539429fc8f60ea2000fcc75e3590da777c78b16dda
SHA5129c9a29ffe7aa0199619da99885c5c23aaf2f0e70b9c43ff6c518aba0e48cd30cacf4c76642e1ae3dcb8de34c4a8130980f3b475e82e1009452737c8ebda08525
-
Filesize
61KB
MD59fca42b7fa3132ded471b886c4bf8a51
SHA186109ac13f8b63bd3467bbf05e39c5cf9bd11d26
SHA256c519bcfc50245700b30cb417478b46810443b03a6447387dd1d0a13966ff00dd
SHA512bbdd590e1bd2971fbc6a462f6501341c0808d658ba3407b051f9d299d9babf0632af092d64c6ad290d4ae5d9db8c367898a064bbea916c516c0a54066ad698ab
-
Filesize
43KB
MD54c30b3e90b3da5619bc0d5f53c025135
SHA1829f487b7c26f6cb8b7f211b2331abbc5229aa61
SHA256b632cedab7ce3d19eebc0d31864dc8c38cd249dcbde299cda818f7026ec294cf
SHA512fd0b36fb43c6b62f6d47455b392276d4e3710b204ef11c70cefed417740a4b5d9357ba37f612f3f87d539175af312ead05bc7a4360fe3e26fd43c56e856e6313
-
Filesize
1KB
MD53432ffcb20bd2689c19a8e9972cee5d8
SHA13309d424bbbd8d302be99ee9323a5680334f449d
SHA256ac5cee045379f0b0c3a095483fd8c102703369cc95898f34f563daaa9c8aab95
SHA51242f88c12926f6074280d1e2e0b24e52d1ad6fe7e387ed14043ae2ddb8fdb7b4cc368695011ca7d561c07e7df1fe24d8247e6293f95011841359083fa4e5cf7d5
-
Filesize
611B
MD55d36403789247a3985f2127eb7d6ec69
SHA1730f39dd4e5026ebd65847e5f46d89907d27151f
SHA2563ec1a3fbb39821d3536415ec6bad30eaee77e5e6ab02c6bd545af8486e240857
SHA512e421320faeb11f2d4b681052dbcfaf3e597950fc77c8707402ca9c146af6fe4f52d7c921a9fc5fc95e5f3ea38f1c874ea9980db2ed1652e0debdadca5a3740c2
-
Filesize
97KB
MD50450ec0d48031c212ac5fceea1dcc663
SHA1540b46738870bdbe377122988240a3b991b93994
SHA2567ba0780291e57a8cc7079bf089151326bbbb88891bfe6360db5876896ed4604c
SHA51261bcf02855909a40b07be4d329c3a3a5a4d05881e983703468ffb65883a82d4f371359bb4ebc86dc9bc0cc09b12aab507ac8ae1c8e96ccfec6055e5b6176dad6
-
Filesize
1.5MB
MD59c28244f2dbe3a4758b532838b0040c9
SHA14b58bb4033d43ae64af6c18db48d5d25e23f6121
SHA256cb770745d547a27a4b99fdbe27a672135f812b29d94fd2b843d06bb5aa1748aa
SHA51224ed3d4c6aae307a0f1bb1f063b211152644b06d7425a5fe24b09f5f747dd63011451cef3f47cc4985b3316cf1213c056d38768ccb7f44cb2fab28cf4e30e969