Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 23:28

General

  • Target

    b97c371dac0ff180da04a5660b9d2b60_JaffaCakes118.exe

  • Size

    783KB

  • MD5

    b97c371dac0ff180da04a5660b9d2b60

  • SHA1

    53fd0eb9e217d364071b46bb6bbcda4e85b51bdc

  • SHA256

    d9921ab733641ce6113a00ffc8fd4ebd6bd07b5c0ac1bb36d8e3b36c28b98209

  • SHA512

    0c54822fd4dd0bb618e15e4b253f8a44401b9367549955e32e47e321bb985764ac50e5e7ac73522c4160cfd224562b4bd1946c1f5c7750d3189b6ec01f8665cf

  • SSDEEP

    12288:jEDklDNl8cLwBsMC5sg2JZgJ/Se7EZXavbCBRITiIBEOVe5NFStKNG8Lufyx+:CWDscMGts5DgtH7eaVT5ED0QG86fa+

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b97c371dac0ff180da04a5660b9d2b60_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b97c371dac0ff180da04a5660b9d2b60_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Windows\SysWOW64\28463\PFAS.exe
      "C:\Windows\system32\28463\PFAS.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\@9C21.tmp

    Filesize

    4KB

    MD5

    d73d89b1ea433724795b3d2b524f596c

    SHA1

    213514f48ece9f074266b122ee2d06e842871c8c

    SHA256

    8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

    SHA512

    8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    97eee85d1aebf93d5d9400cb4e9c771b

    SHA1

    26fa2bf5fce2d86b891ac0741a6999bff31397de

    SHA256

    30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

    SHA512

    8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

  • C:\Windows\SysWOW64\28463\PFAS.001

    Filesize

    398B

    MD5

    d390b7c9f0a6a44971502f3aa837723a

    SHA1

    56ce8293f03f850d6b5d5138817ba31fff2e464b

    SHA256

    5c7bb33774caead3b935cbc7dee8f0ed28a8c53ccb846416dbba4338a89273c6

    SHA512

    c9123a361f28df60189c0eec03de0c2d8691f65facf62d2871d68edca7b324870befbc6198f499eb72aa4efa197ef8ddc5a50266997696ab0110ed0d68c14e81

  • C:\Windows\SysWOW64\28463\PFAS.006

    Filesize

    8KB

    MD5

    35b24c473bdcdb4411e326c6c437e8ed

    SHA1

    ec1055365bc2a66e52de2d66d24d742863c1ce3d

    SHA256

    4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

    SHA512

    32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

  • C:\Windows\SysWOW64\28463\PFAS.007

    Filesize

    5KB

    MD5

    a8e19de6669e831956049685225058a8

    SHA1

    6d2546d49d92b18591ad4fedbc92626686e7e979

    SHA256

    34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

    SHA512

    5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

  • C:\Windows\SysWOW64\28463\PFAS.exe

    Filesize

    646KB

    MD5

    b863a9ac3bcdcde2fd7408944d5bf976

    SHA1

    4bd106cd9aefdf2b51f91079760855e04f73f3b0

    SHA256

    0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

    SHA512

    4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    105B

    MD5

    27c90d4d9b049f4cd00f32ed1d2e5baf

    SHA1

    338a3ea8f1e929d8916ece9b6e91e697eb562550

    SHA256

    172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb

    SHA512

    d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae

  • memory/1404-24-0x0000000002550000-0x0000000002551000-memory.dmp

    Filesize

    4KB

  • memory/1404-36-0x00000000033B0000-0x00000000033B1000-memory.dmp

    Filesize

    4KB

  • memory/1404-27-0x0000000002520000-0x0000000002521000-memory.dmp

    Filesize

    4KB

  • memory/1404-26-0x0000000002560000-0x0000000002561000-memory.dmp

    Filesize

    4KB

  • memory/1404-25-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/1404-29-0x0000000003360000-0x0000000003361000-memory.dmp

    Filesize

    4KB

  • memory/1404-23-0x0000000002500000-0x0000000002501000-memory.dmp

    Filesize

    4KB

  • memory/1404-30-0x0000000003350000-0x0000000003353000-memory.dmp

    Filesize

    12KB

  • memory/1404-33-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/1404-28-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/1404-35-0x0000000003370000-0x0000000003371000-memory.dmp

    Filesize

    4KB

  • memory/1404-34-0x0000000000560000-0x0000000000561000-memory.dmp

    Filesize

    4KB

  • memory/1404-31-0x00000000033A0000-0x00000000033A1000-memory.dmp

    Filesize

    4KB

  • memory/1404-32-0x00000000033A0000-0x00000000033A1000-memory.dmp

    Filesize

    4KB

  • memory/1404-21-0x0000000000B30000-0x0000000000B8A000-memory.dmp

    Filesize

    360KB

  • memory/1404-20-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/1404-44-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/1404-45-0x0000000000B30000-0x0000000000B8A000-memory.dmp

    Filesize

    360KB

  • memory/1404-46-0x00000000033A0000-0x00000000033A1000-memory.dmp

    Filesize

    4KB

  • memory/1404-50-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB