Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe
-
Size
1020KB
-
MD5
bd229a3a17248f8cd4b8f224ce9d44b3
-
SHA1
fb9206a0ace2e721842a86c76693199cd97ec344
-
SHA256
0e7f047f9e6ba43c544b6771d2c7becc67c1d01df9e691e442c16e36d66b3e2e
-
SHA512
611b74f394164b182c8867b0ed0ad92992709f8bbdb8a76735fd790d353ad09366dcdd552ad35cbc86c46045c26b3afeef219322abd0fcde56ccdf057e109fb0
-
SSDEEP
24576:xUFYB1OlMu9k2vwKhKKXd5rCDOzB9iKq8JIBfD2VdpUncPuhS:xt1O2BKlRzCDIB9iKq8SBC3pOcF
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x000700000002343a-37.dat family_ardamax -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation Exporer32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation KWVE.exe -
Executes dropped EXE 2 IoCs
pid Process 860 Exporer32.exe 4576 KWVE.exe -
Loads dropped DLL 5 IoCs
pid Process 860 Exporer32.exe 4576 KWVE.exe 4576 KWVE.exe 4576 KWVE.exe 5056 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KWVE Agent = "C:\\Windows\\SysWOW64\\28463\\KWVE.exe" KWVE.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\KWVE.001 Exporer32.exe File created C:\Windows\SysWOW64\28463\KWVE.006 Exporer32.exe File created C:\Windows\SysWOW64\28463\KWVE.007 Exporer32.exe File created C:\Windows\SysWOW64\28463\KWVE.exe Exporer32.exe File created C:\Windows\SysWOW64\28463\AKV.exe Exporer32.exe File opened for modification C:\Windows\SysWOW64\28463 KWVE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5056 4576 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exporer32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ = "ADODB.Stream" bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\System\\ado\\msado15.dll" bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\VersionIndependentProgID bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\VersionIndependentProgID\ = "ADODB.Stream" bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA} bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ThreadingModel = "Apartment" bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID\ = "ADODB.Stream.6.0" bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: 33 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe Token: 33 4576 KWVE.exe Token: SeIncBasePriorityPrivilege 4576 KWVE.exe Token: SeIncBasePriorityPrivilege 4576 KWVE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 4576 KWVE.exe 4576 KWVE.exe 4576 KWVE.exe 4576 KWVE.exe 4576 KWVE.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3188 wrote to memory of 860 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 94 PID 3188 wrote to memory of 860 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 94 PID 3188 wrote to memory of 860 3188 bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe 94 PID 860 wrote to memory of 4576 860 Exporer32.exe 95 PID 860 wrote to memory of 4576 860 Exporer32.exe 95 PID 860 wrote to memory of 4576 860 Exporer32.exe 95 PID 4576 wrote to memory of 4628 4576 KWVE.exe 104 PID 4576 wrote to memory of 4628 4576 KWVE.exe 104 PID 4576 wrote to memory of 4628 4576 KWVE.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd229a3a17248f8cd4b8f224ce9d44b3_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\28463\KWVE.exe"C:\Windows\system32\28463\KWVE.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 11084⤵
- Loads dropped DLL
- Program crash
PID:5056
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\KWVE.exe > nul4⤵
- System Location Discovery: System Language Discovery
PID:4628
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4576 -ip 45761⤵PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD513e10cd76f11d6cb43182dcba7370171
SHA1e6b8ce329e49ff09f1cb529c60fc466cb9a579c8
SHA256f1265c88f0077009eaa18db413f156cc7ad8d41dc9d797dd1032b0e0ae9c40d5
SHA512ee32ef3f50838936417e51dfd365b166456900e327dbe51902700bb3d562dea22e6fbd9009c822ba0562687001802a2e61d38123f81ae19f7b3d05bb1fd5cda8
-
Filesize
507KB
MD5a5f7f3556110e2f9e19d537aea8a10be
SHA126d7fef9f3c6bee6539a4717f6d5989608727568
SHA25671907e7cd27b2925e0a8288173e2271fd9974d45fd5294dac9e4cb4686f4523f
SHA512ae68338dda0d29e6da3db95291a6060f50d6a8fb103e35ce42fd3c1fe2d2fd193b215d1c3a7fdd04578b80bd36c52b986ecf7ab2948d7bbe926853969e41b2e1
-
Filesize
395KB
MD5adbec81b510dcfe49835f95940ef961d
SHA177940f6e46fbd5f53de23bd49afe9172470769d0
SHA256466efb4b00255f21075b340fc2d2444f182947ab90270840543658c5fd3a9b95
SHA512ef4324a06fbe960933f5551ea6ac587cd87cb6025bc6879a2b81a4d1033cfe87e244b6a87fb5db5ad065321ccbe8035cf24a668452d5b0c6a4063a355a12b2a7
-
Filesize
450B
MD5c09bc97f8d66c59a1bb8b14707e4399c
SHA184c6ae17f87424e3f07c4af979964cde6d16d343
SHA256661ab56e7de6dbaba82919f57be250bcd0149d08207cbccd57f50be4f0d2d62f
SHA512c4c508791f211f7bbed790ffa149e3e6d81fe7980366a898b8c9fe7fbb40d8ad67f2cee68bf624899dc00174aedea30c77ff901e74467f43bdbbf6fbece1e054
-
Filesize
8KB
MD5f5eff4f716427529b003207d5c953df5
SHA179696d6c8d67669ea690d240ef8978672e3d151c
SHA256ac54ebb9eec3212f294462ce012fdc42f4b0896d785d776a5a2cc3599dc5bcde
SHA5125a48599a5855f06c3e7d6f89c4e06bab1f4381b9d30cf3824c465b8fd6c142b316e6bd6aaad73d1f9b3e84d96113fb5e7374831bf503744013c9e1a0632a0caf
-
Filesize
5KB
MD5bc75eddaa64823014fef0fe70bd34ffc
SHA115cd2ace3b68257faed33c78b794b2333eab7c0a
SHA2569eada36d17635bedb85ce96a62cb019dbfee696b9986f69de7d5b5bc1f44df5d
SHA51220db25f32f9cfdbffa4f30c0065125052c6e20b7dcc147fa7ebff38e37b51f6a43e48e486f148d7ee11671479b9fb0bbe1c6df151101af3b50c65fd334d13baa
-
Filesize
473KB
MD53c90d45b1c004e86a7f7a7a340f1abc8
SHA110602c450bcbda2735dc036f2e399646f0c64f4c
SHA256f6d9c3bba7fc4dfa681cadf68f41093e3c431501c6789e891e599719e5d2781c
SHA51285457be4c2aa76ede288cd185131d46e5f0b37187313f3a54fe789e28929ec6e44282f4ba0981f46354705cd5da83990586c8846f52fcdb807908254c8719cc1