Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 17:25

General

  • Target

    abe7941a771703eeaf5e47634f942799_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    abe7941a771703eeaf5e47634f942799

  • SHA1

    0d2eff68aaeb3963e5faa98e3213e25ad9b1e50c

  • SHA256

    bd606273b31dd6f9e49f9e210d6af408a71bf8e481709a8a7b37680becaa8fb7

  • SHA512

    c2b30708a78bc6b64f91e8a65ed06f84132caa8e315fd50020749807694ca99da514e2416aa8620ff197897ed599f84cd8a2258043cab9ccdb46449fb82f696c

  • SSDEEP

    24576:VzwTT6GVHp48E7gJLeZWMcn3WLNK1dJbr9gQ91H7:Vz+TbV9kOLeMMcn3WLNubrTH

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abe7941a771703eeaf5e47634f942799_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\abe7941a771703eeaf5e47634f942799_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5636
    • C:\Windows\SysWOW64\AVCAKW\BLP.exe
      "C:\Windows\system32\AVCAKW\BLP.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1756
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3820,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8
    1⤵
      PID:5520

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\AVCAKW\AKV.exe

      Filesize

      485KB

      MD5

      42150775d201a85ebc379d21aa253f85

      SHA1

      fccd7df34e16abaf8d55935016cdb15df8041e06

      SHA256

      00206ccef9ee8da111cc547c698b7e61736b328de48ac5c307d05f2921ef0b9c

      SHA512

      4ff3c587a8d88e319acb028829c75ecb3e11c16a62ba9c2090720613c51c6555af698ba8ff75672b405602f196ed1b99dbeb9395bae62aac2140fa31600b36e0

    • C:\Windows\SysWOW64\AVCAKW\BLP.001

      Filesize

      61KB

      MD5

      9681d3e1f2c53ad98b8467b3acca33fc

      SHA1

      04d5d08781f27d6e08ad0262f7325b2be4db7743

      SHA256

      baecddca15ea6932b9cd4e7f5bae848c3c290660a85c408b898150c6f8fd744e

      SHA512

      5c6191fb676ace9d1c2ddfd4e98651959ab24b718ab626c343e2bb271d31edd8ba43ed9de528c7832ddcc2137d2424c22bb19f115dc252e1400cfcd3edce2098

    • C:\Windows\SysWOW64\AVCAKW\BLP.002

      Filesize

      44KB

      MD5

      e65e4bdb2c86226589b88f101153c01b

      SHA1

      731be43621721dba20f0bb74966ea08043ef37fd

      SHA256

      e8a9477bc04824357c0f0bcc1cb665e1dfb6cf5c05f68517749f6cb11821cec2

      SHA512

      7700ee197f109a8f2cff2e529715e371e36c1d9924af0bedef9285f76898d3448847af3bff342813b9bd8ca619b7c39b9607150596008ffc6fe68b338f6769cd

    • C:\Windows\SysWOW64\AVCAKW\BLP.004

      Filesize

      1KB

      MD5

      ccd120b1bf54d4ff5364eae38227078d

      SHA1

      b4465d096fdca0b9b703ac71c28abf343d6d9256

      SHA256

      d1c861cc843b2ab3a5c08a4162f860fd38b5b57ab4ad0e30cd7b1fece8dc8d49

      SHA512

      718a635ccfb282a4142d35956b8b984d351c0970996515fe86f818ee766e0c19b4c3dab01784029102af63f94cdc32f9b61d212bf019ccc05a9308fe6db5a100

    • C:\Windows\SysWOW64\AVCAKW\BLP.exe

      Filesize

      1.7MB

      MD5

      9a6a50772539f5a61fefa29c34666223

      SHA1

      b2b8650d817ef7d86bfef48420e9716f0ffdccce

      SHA256

      93db12799d366bbb10f28b923188e3f1457b3ec931ddf33ddeb131a80e46f00b

      SHA512

      eb5f89e6b27981d85dc235edc477a4397d08b9e89d638b0e07301a26ca6e640f12251fdcfe1386df4167a2928bc60959289329531bc7a9e14a232ead22935fed

    • memory/1756-16-0x0000000000650000-0x0000000000651000-memory.dmp

      Filesize

      4KB

    • memory/1756-18-0x0000000000650000-0x0000000000651000-memory.dmp

      Filesize

      4KB