Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
c2a515d55b4a49d91bc12c082ba71734
-
SHA1
0d5e6455c9ac4079a12e1e77b7e967c2e28f57d4
-
SHA256
2097ad276b66fbb9879d0b9ec0386baa98af9a734e739a75f69f0fbf7b940404
-
SHA512
d20b5cd27554d7bc41279d6f0cbcad97c1341dd9b65c3f3595dad5915fcca92d892b50ed45701c47c9b87f3f8b4ff361ac8f8a20582ac68053cfb48c0b89db80
-
SSDEEP
24576:pU4oTXtOxVFzsnSZ9jt3pzrFCa0U9vv5oUQ3e3CFaqaabZb/JgBKdeO5fW:pULT4V2Szjtr/ppQ3eSFansZlgBKo
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0006000000019255-6.dat family_ardamax -
Executes dropped EXE 1 IoCs
pid Process 628 TVF.exe -
Loads dropped DLL 2 IoCs
pid Process 1696 c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe 628 TVF.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TVF Start = "C:\\Windows\\SysWOW64\\REOIMR\\TVF.exe" TVF.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\REOIMR\TVF.exe c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\REOIMR\ TVF.exe File created C:\Windows\SysWOW64\REOIMR\TVF.004 c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe File created C:\Windows\SysWOW64\REOIMR\TVF.001 c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe File created C:\Windows\SysWOW64\REOIMR\TVF.002 c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe File created C:\Windows\SysWOW64\REOIMR\AKV.exe c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVF.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 628 TVF.exe Token: SeIncBasePriorityPrivilege 628 TVF.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 628 TVF.exe 628 TVF.exe 628 TVF.exe 628 TVF.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1696 wrote to memory of 628 1696 c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe 30 PID 1696 wrote to memory of 628 1696 c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe 30 PID 1696 wrote to memory of 628 1696 c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe 30 PID 1696 wrote to memory of 628 1696 c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c2a515d55b4a49d91bc12c082ba71734_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\REOIMR\TVF.exe"C:\Windows\system32\REOIMR\TVF.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD548cfaed4d566c34716326302b49bdad2
SHA1566e0989b6bc7ed205f9ae250ea98e3a4d7fba52
SHA25654c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea
SHA51296c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0
-
Filesize
60KB
MD5a15c556f17d7db8287e023138942d5db
SHA1880bf8ec944120830dc2e2e040e5996e4e0e6c83
SHA256f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e
SHA512930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd
-
Filesize
43KB
MD5daabecdfba287a3333b60ae82211acd7
SHA1e67b4c7bf0dd71ad47263a58bb60be4bce504b84
SHA25612981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173
SHA512937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f
-
Filesize
1KB
MD52e3fb6dd721c98cba402da4b7f39ea8d
SHA1def1d77633c78113c5600c780d4588a9c73e53be
SHA2563b47a35f1372aff4ad1835099b1b8db8ebbcb54b656deca535305f22992690e2
SHA512b61f3ce946e8f661994ca6de818ac322b157a016dc73c943dae6cc7f2794e0a52521d8f21663562f75b666c1f3c3a50a476673b93b12508e8fe142a8d2596230
-
Filesize
1.7MB
MD5f3819a6cab8ae058254c4abb3844d87e
SHA10f8b1a74af87f1823ec0d76e21a8d54d55a53a8b
SHA2563d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9
SHA512dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57