Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2024, 08:41

General

  • Target

    c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    c2a515d55b4a49d91bc12c082ba71734

  • SHA1

    0d5e6455c9ac4079a12e1e77b7e967c2e28f57d4

  • SHA256

    2097ad276b66fbb9879d0b9ec0386baa98af9a734e739a75f69f0fbf7b940404

  • SHA512

    d20b5cd27554d7bc41279d6f0cbcad97c1341dd9b65c3f3595dad5915fcca92d892b50ed45701c47c9b87f3f8b4ff361ac8f8a20582ac68053cfb48c0b89db80

  • SSDEEP

    24576:pU4oTXtOxVFzsnSZ9jt3pzrFCa0U9vv5oUQ3e3CFaqaabZb/JgBKdeO5fW:pULT4V2Szjtr/ppQ3eSFansZlgBKo

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\SysWOW64\REOIMR\TVF.exe
      "C:\Windows\system32\REOIMR\TVF.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\REOIMR\AKV.exe

    Filesize

    456KB

    MD5

    48cfaed4d566c34716326302b49bdad2

    SHA1

    566e0989b6bc7ed205f9ae250ea98e3a4d7fba52

    SHA256

    54c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea

    SHA512

    96c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0

  • C:\Windows\SysWOW64\REOIMR\TVF.001

    Filesize

    60KB

    MD5

    a15c556f17d7db8287e023138942d5db

    SHA1

    880bf8ec944120830dc2e2e040e5996e4e0e6c83

    SHA256

    f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e

    SHA512

    930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd

  • C:\Windows\SysWOW64\REOIMR\TVF.002

    Filesize

    43KB

    MD5

    daabecdfba287a3333b60ae82211acd7

    SHA1

    e67b4c7bf0dd71ad47263a58bb60be4bce504b84

    SHA256

    12981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173

    SHA512

    937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f

  • C:\Windows\SysWOW64\REOIMR\TVF.004

    Filesize

    1KB

    MD5

    2e3fb6dd721c98cba402da4b7f39ea8d

    SHA1

    def1d77633c78113c5600c780d4588a9c73e53be

    SHA256

    3b47a35f1372aff4ad1835099b1b8db8ebbcb54b656deca535305f22992690e2

    SHA512

    b61f3ce946e8f661994ca6de818ac322b157a016dc73c943dae6cc7f2794e0a52521d8f21663562f75b666c1f3c3a50a476673b93b12508e8fe142a8d2596230

  • \Windows\SysWOW64\REOIMR\TVF.exe

    Filesize

    1.7MB

    MD5

    f3819a6cab8ae058254c4abb3844d87e

    SHA1

    0f8b1a74af87f1823ec0d76e21a8d54d55a53a8b

    SHA256

    3d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9

    SHA512

    dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57

  • memory/628-15-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/628-17-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB