Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
66s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe
-
Size
915KB
-
MD5
c83be3f6144b525a4364986128a0c60b
-
SHA1
de807cb5a296f8430e32140c164e2bce9bd6d780
-
SHA256
49ae50caaf68f37681985f2c84e53a37f51cddc4a5f6ebb48164c32e54b8a89c
-
SHA512
6413c61183a17a3075b0e6e110c40256d6b28fec97cadd0f36d61891a7980142fc5a9f836954ab9e34ceded219a3f6124448afc35fdfcd5d25d9b46568714ee2
-
SSDEEP
24576:wuT+75oFgIGMjhlINPHsTHUges8MzQ6ub+hBXF0ILB/:wVUgI9hyNPHsT0geozdBXKILp
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0007000000015f37-9.dat family_ardamax -
Executes dropped EXE 1 IoCs
pid Process 2428 EXAD.exe -
Loads dropped DLL 7 IoCs
pid Process 1736 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe 1736 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe 2428 EXAD.exe 1736 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe 2988 DllHost.exe 2428 EXAD.exe 2988 DllHost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EXAD Agent = "C:\\Windows\\SysWOW64\\28463\\EXAD.exe" EXAD.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\EXAD.001 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\EXAD.006 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\EXAD.007 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\EXAD.exe c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\key.bin c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AKV.exe c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 EXAD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 43 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\MiscStatus\ = "0" EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\ EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\ = "Microsoft Feeds 2.0 Object Library" EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\0\win32\ = "C:\\Windows\\SysWOW64\\msfeeds.dll" EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\FLAGS\ EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\FLAGS\ = "0" EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\Version EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\Version\ EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\Control\ EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\TypeLib\ = "{79911628-57E9-E787-2006-508CF88E9864}" EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\VersionIndependentProgID\ = "Rdpvcomapi.RDPViewer" EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\Programmable\ EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\ EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\0 EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\0\win32 EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\0\win64\ = "C:\\Windows\\SysWow64\\msfeeds.dll" EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\FLAGS EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\Version\ = "1.0" EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7} EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\InprocServer32\ = "%SystemRoot%\\SysWow64\\rdpencom.dll" EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\TypeLib\ EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\InprocServer32 EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\InprocServer32\ EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\Programmable EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\ToolboxBitmap32\ EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\ToolboxBitmap32\ = "%SystemRoot%\\SysWow64\\rdpencom.dll, 1" EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\0\ EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\MiscStatus EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\ProgID\ EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0 EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\VersionIndependentProgID EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\ = "Ijefezri Noqepaha Linita Object" EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\Control EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\MiscStatus\ EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864} EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\0\win32\ EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\0\win64 EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\TypeLib EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\VersionIndependentProgID\ EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\ProgID EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\ProgID\ = "Rdpvcomapi.RDPViewer.1" EXAD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4748CBA5-03B8-4AD5-DCBF-2D7D493B56C7}\ToolboxBitmap32 EXAD.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{79911628-57E9-E787-2006-508CF88E9864}\2.0\0\win64\ EXAD.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 2428 EXAD.exe Token: SeIncBasePriorityPrivilege 2428 EXAD.exe Token: SeIncBasePriorityPrivilege 2428 EXAD.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 DllHost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2428 EXAD.exe 2428 EXAD.exe 2428 EXAD.exe 2428 EXAD.exe 2428 EXAD.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2428 1736 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe 30 PID 1736 wrote to memory of 2428 1736 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe 30 PID 1736 wrote to memory of 2428 1736 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe 30 PID 1736 wrote to memory of 2428 1736 c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe 30 PID 2428 wrote to memory of 3044 2428 EXAD.exe 32 PID 2428 wrote to memory of 3044 2428 EXAD.exe 32 PID 2428 wrote to memory of 3044 2428 EXAD.exe 32 PID 2428 wrote to memory of 3044 2428 EXAD.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\28463\EXAD.exe"C:\Windows\system32\28463\EXAD.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\EXAD.exe > nul3⤵
- System Location Discovery: System Language Discovery
PID:3044
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD5671c8368b28313d606f676607074667d
SHA18b8fefc30f24c35f465fe43791b6fb23bfdeae48
SHA2569b18fae7b21c42cba2dcc2a528032699c0c29d1fac528472ed7112f060591a7e
SHA5128ae2311c41e9ddacbd9ae71949c9ae39764ab5e967529b0cadf74151059b87fdb946a63db7018c2ca682d8269e66713b5d7227f25464177abe92fdbc838e5f90
-
Filesize
457KB
MD5f34b87951e1a931e01df1bc9f1b98207
SHA1f3cc94e72bf7e9bf2afa7d8dbfef0ca2087358a1
SHA256e6cf7cdc5895da8a65f8c4a1a1d0d0583218a1c28f66d25dc56fa67f9c34ed5b
SHA512c2438d88489b9ed7c6c875ecde07411a488eac9115358c73f72d7029874f75803ebead03a41692a900648fb2b2be63b7c8b4e3a71984261185b6d5d6d7201641
-
Filesize
440B
MD5d36f59acdd02d2455c013272cf5750ad
SHA14a4e6c5aeffc594140691d53bc5daf6c5fd56a0f
SHA256a2bf527b859b1ec072984d2fec28c6d63baa7723f437eeb562d3610d3b7b38f3
SHA512d8effb46e9a72d136dd020dbf73fa1d4db6677fcb41f97f0c06d504fff471f12277efaa50bb4c90ed99f2e3544a52124c9b60a805ba4af851ad04a3931be15da
-
Filesize
8KB
MD598d22fb2035a26a6b9b7decc0c0ff2fa
SHA143a75cf59fc2f8b59b1d962b4e685249eef816d5
SHA256fd5c03fd9ea47c1e820d19bd307ad7c4e53f4b65d288cb675b05cbe76c9b5c25
SHA5123cb7f765d6f4d1dc08a0087086f3fe243bd8ff9e699607cf1e4177892576665c0c799307751cba16fd3f1482e5abb884090024431be2ce86d4080f1d1134d91f
-
Filesize
5KB
MD515eb312db4b3e208b67082653acb8a02
SHA1b0926b1e1733baa3d7f18d3806916f92704fccff
SHA25672347b6d619bc7204a155486e4d09a62a4a494c35a8121349bfe2fecd5af99a8
SHA5127e8d451bc9d1e83615db15d6cdf68230cdd333fa38362979f0408dc80bf680859a2bc3fc09c494805731317b0f136c3227226092f1bcc31c2c80cb73071aa443
-
Filesize
105B
MD527c90d4d9b049f4cd00f32ed1d2e5baf
SHA1338a3ea8f1e929d8916ece9b6e91e697eb562550
SHA256172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb
SHA512d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae
-
Filesize
4KB
MD536400e746829504282eb26b364826aa9
SHA1d39ea9da98be0c331fd71002645f4f40664288a2
SHA256c7ab756437211f6e0e3dcd7482bc67cb910e504345902049eb8abe34a656deb0
SHA5125fe8fae2f5fcbd42c72cc8f6dd70aeec0afd94af5cfd905441630755790dc6ed346823ee009c21537b9cdb3b7b7a39eeed933606726ffd891dae47b60465f640
-
Filesize
651KB
MD5b181beaba4204ac3ce7bc8e6f0b74312
SHA14ab13763d2ecdf0968f15a39302aab2b1f0ab462
SHA256f36bad234fd1599dd1398d20bc57499314fe96d5de20074536067b2d3c2b4f2d
SHA512d1aaa2fd25e53986c8ea8213a8a02515927c9e9aa3e4d8077a138a29ba32c807ec81473b672a22ffb6ba26126ccd7e1d310e057ef964d3b21b1672a67af5fd7b