Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 11:49

General

  • Target

    b783a504f148258f73a69624797b73c1_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    b783a504f148258f73a69624797b73c1

  • SHA1

    da059a9a5c87cd5ee6af2b0c1cd0dbb75a3f6fbe

  • SHA256

    fd022bb153a8c256d5bbfd4c3b40aac3ad65bbe6c57ffc4acd284714cba649ef

  • SHA512

    e3088fb05d73075d83569ce2470801330f7430c9b0dd7afcb15298bfa2844e24f9f45f4f972cd5adeaa79b5abc00f3286449b5472ad1d8f954fd7003e1d244e6

  • SSDEEP

    24576:IxEGC4ps8fG/7ZEJY++RJs1L9GG+Q/dsECc:IxKafutwTwm1hBB/nJ

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b783a504f148258f73a69624797b73c1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b783a504f148258f73a69624797b73c1_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\INSTALL.EXE
      "C:\INSTALL.EXE"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\SysWOW64\28463\UUYK.exe
        "C:\Windows\system32\28463\UUYK.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 1072
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:4296
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\UUYK.exe > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2216
    • C:\NE2X VOICE LAGGER 1.0.EXE
      "C:\NE2X VOICE LAGGER 1.0.EXE"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3616
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2572 -ip 2572
    1⤵
      PID:2824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\INSTALL.EXE

      Filesize

      480KB

      MD5

      d44e31d7a580b492034af034d60ddbb6

      SHA1

      955d97b3f347a0480b3624e48f96a7656e4d8de5

      SHA256

      7f360452adb853d0fe760de1aea7fb3050a308a240b8e43a3a20272f865edb21

      SHA512

      e5977b1fa8cde8ec9c95687f3a83965fcf304ffe8007b7f72d615c2f42294328f4abd8fc137e4fd17f25ca86fd7fa4ddbb629a533550dc2c4157fe0cb5a21137

    • C:\NE2X VOICE LAGGER 1.0.EXE

      Filesize

      384KB

      MD5

      fb57af7d231d0da9e35a4dbb0f6af892

      SHA1

      fbb469c0eccadb0360da09dd7857bc9de0e6dc83

      SHA256

      39eef35e4c0bb2ae372acb2efe8ddf0b8632b119b5d318e18bfa292e6817bb18

      SHA512

      2ae3e86dfac403a4dc92685cde6fd598493cd3ab7d6d721a1938311c8529e833d7c40065d383864a297d026522cb793b50771e6f00c51ca63a76e406ff26b862

    • C:\Users\Admin\AppData\Local\Temp\@A43F.tmp

      Filesize

      4KB

      MD5

      c3679c3ff636d1a6b8c65323540da371

      SHA1

      d184758721a426467b687bec2a4acc80fe44c6f8

      SHA256

      d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb

      SHA512

      494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

    • C:\Windows\SysWOW64\28463\AKV.exe

      Filesize

      395KB

      MD5

      b8fa30233794772b8b76b4b1d91c7321

      SHA1

      0cf9561be2528944285e536f41d502be24c3aa87

      SHA256

      14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a

      SHA512

      10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d

    • C:\Windows\SysWOW64\28463\UUYK.001

      Filesize

      392B

      MD5

      c2332ac7ac936dd16f3b31d29f03a3df

      SHA1

      0a758f7a2c39e894db330e2ad479e22677fb2bd2

      SHA256

      1c124f308fd5c4833edda632307144e29bd008884b83d825831eb391ff6fd836

      SHA512

      d0912fdf00b85160d9fcc186fed64c0d9cf86f5daf330655b3cd56cb058f481ec77b0f032256998fb9fd5d59955fe504bf14979ce7cdfc16d98c12958294f26a

    • C:\Windows\SysWOW64\28463\UUYK.006

      Filesize

      8KB

      MD5

      43f02e9974b1477c1e6388882f233db0

      SHA1

      f3e27b231193f8d5b2e1b09d05ae3a62795cf339

      SHA256

      3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba

      SHA512

      e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

    • C:\Windows\SysWOW64\28463\UUYK.007

      Filesize

      5KB

      MD5

      b5a87d630436f958c6e1d82d15f98f96

      SHA1

      d3ff5e92198d4df0f98a918071aca53550bf1cff

      SHA256

      a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2

      SHA512

      fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

    • C:\Windows\SysWOW64\28463\UUYK.exe

      Filesize

      473KB

      MD5

      17535dddecf8cb1efdba1f1952126547

      SHA1

      a862a9a3eb6c201751be1038537522a5281ea6cb

      SHA256

      1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd

      SHA512

      b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

    • memory/632-0-0x00000000022B0000-0x00000000022B1000-memory.dmp

      Filesize

      4KB

    • memory/632-29-0x0000000000400000-0x0000000000534000-memory.dmp

      Filesize

      1.2MB