Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 19:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
a7d7bf355ec60f5ac228e0d52259e3da
-
SHA1
efbfd32a3319c41030bad06c721b08838e82f41d
-
SHA256
cbfded9c35b09eaddac1c4957423cd563f9ab8e7ac8a4831e33478a7723639a9
-
SHA512
795772f01a42e5e2cfbc096a2f2dc4006b96ada5ca29b0f74ae6db90af60f9b6b92637e5a242755b238e6018eb1ecb9d86e0e30df1f018aab419a52fbeef0e81
-
SSDEEP
24576:FOfVkHfxVtux+qI+yMNa73L+TL84qc6Xx6:FONIvTLMN2LlTXx
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x000700000002344d-42.dat family_ardamax -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3136 Exporer32.exe -
Loads dropped DLL 1 IoCs
pid Process 3136 Exporer32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\OENL.001 Exporer32.exe File created C:\Windows\SysWOW64\28463\OENL.006 Exporer32.exe File created C:\Windows\SysWOW64\28463\OENL.007 Exporer32.exe File created C:\Windows\SysWOW64\28463\OENL.exe Exporer32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exporer32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\ProgID a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45} a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\InprocServer32 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\InprocServer32\ = "C:\\Windows\\SysWOW64\\IME\\IMEJP\\imjpdapi.dll" a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\InprocServer32\ThreadingModel = "Both" a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\ = "CImeDictAPILocalWordComment Class" a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\ProgID\ = "CImeDictAPILocalWordComment.15" a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\VersionIndependentProgID a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FC0F1AF-B66B-1061-1756-2D6578A0EA45}\VersionIndependentProgID\ = "CImeDictAPILocalWordComment" a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Token: 33 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 2752 wrote to memory of 4444 2752 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 84 PID 4444 wrote to memory of 3136 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 97 PID 4444 wrote to memory of 3136 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 97 PID 4444 wrote to memory of 3136 4444 a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7d7bf355ec60f5ac228e0d52259e3da_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3136 -
C:\Windows\SysWOW64\28463\OENL.exe"C:\Windows\system32\28463\OENL.exe"4⤵PID:4456
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
480KB
MD5fc5de561e93892e45f9b034dbfa4f575
SHA15423374a92a48e7004c90ec0bb3b246becea0410
SHA256546210e2c69564a87068b01bcdd04338164f7929b83d9a611c4cfcb22415e2e1
SHA5125ba01eda2dd7322b7daa5cfd1a7b33d5eb37dca2cc94b2c157fde1e689bd85a0944df61c6415e25f019acf3a6c34814e0baaa09fdad8a427f10c8d68c3f24266
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8