Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 04:39

General

  • Target

    c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe

  • Size

    915KB

  • MD5

    c83be3f6144b525a4364986128a0c60b

  • SHA1

    de807cb5a296f8430e32140c164e2bce9bd6d780

  • SHA256

    49ae50caaf68f37681985f2c84e53a37f51cddc4a5f6ebb48164c32e54b8a89c

  • SHA512

    6413c61183a17a3075b0e6e110c40256d6b28fec97cadd0f36d61891a7980142fc5a9f836954ab9e34ceded219a3f6124448afc35fdfcd5d25d9b46568714ee2

  • SSDEEP

    24576:wuT+75oFgIGMjhlINPHsTHUges8MzQ6ub+hBXF0ILB/:wVUgI9hyNPHsT0geozdBXKILp

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c83be3f6144b525a4364986128a0c60b_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Windows\SysWOW64\28463\EXAD.exe
      "C:\Windows\system32\28463\EXAD.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 1132
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:1660
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\EXAD.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:652
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3512 -ip 3512
    1⤵
      PID:1460

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\@A0B4.tmp

      Filesize

      4KB

      MD5

      36400e746829504282eb26b364826aa9

      SHA1

      d39ea9da98be0c331fd71002645f4f40664288a2

      SHA256

      c7ab756437211f6e0e3dcd7482bc67cb910e504345902049eb8abe34a656deb0

      SHA512

      5fe8fae2f5fcbd42c72cc8f6dd70aeec0afd94af5cfd905441630755790dc6ed346823ee009c21537b9cdb3b7b7a39eeed933606726ffd891dae47b60465f640

    • C:\Windows\SysWOW64\28463\AKV.exe

      Filesize

      457KB

      MD5

      f34b87951e1a931e01df1bc9f1b98207

      SHA1

      f3cc94e72bf7e9bf2afa7d8dbfef0ca2087358a1

      SHA256

      e6cf7cdc5895da8a65f8c4a1a1d0d0583218a1c28f66d25dc56fa67f9c34ed5b

      SHA512

      c2438d88489b9ed7c6c875ecde07411a488eac9115358c73f72d7029874f75803ebead03a41692a900648fb2b2be63b7c8b4e3a71984261185b6d5d6d7201641

    • C:\Windows\SysWOW64\28463\EXAD.001

      Filesize

      440B

      MD5

      d36f59acdd02d2455c013272cf5750ad

      SHA1

      4a4e6c5aeffc594140691d53bc5daf6c5fd56a0f

      SHA256

      a2bf527b859b1ec072984d2fec28c6d63baa7723f437eeb562d3610d3b7b38f3

      SHA512

      d8effb46e9a72d136dd020dbf73fa1d4db6677fcb41f97f0c06d504fff471f12277efaa50bb4c90ed99f2e3544a52124c9b60a805ba4af851ad04a3931be15da

    • C:\Windows\SysWOW64\28463\EXAD.006

      Filesize

      8KB

      MD5

      98d22fb2035a26a6b9b7decc0c0ff2fa

      SHA1

      43a75cf59fc2f8b59b1d962b4e685249eef816d5

      SHA256

      fd5c03fd9ea47c1e820d19bd307ad7c4e53f4b65d288cb675b05cbe76c9b5c25

      SHA512

      3cb7f765d6f4d1dc08a0087086f3fe243bd8ff9e699607cf1e4177892576665c0c799307751cba16fd3f1482e5abb884090024431be2ce86d4080f1d1134d91f

    • C:\Windows\SysWOW64\28463\EXAD.007

      Filesize

      5KB

      MD5

      15eb312db4b3e208b67082653acb8a02

      SHA1

      b0926b1e1733baa3d7f18d3806916f92704fccff

      SHA256

      72347b6d619bc7204a155486e4d09a62a4a494c35a8121349bfe2fecd5af99a8

      SHA512

      7e8d451bc9d1e83615db15d6cdf68230cdd333fa38362979f0408dc80bf680859a2bc3fc09c494805731317b0f136c3227226092f1bcc31c2c80cb73071aa443

    • C:\Windows\SysWOW64\28463\EXAD.exe

      Filesize

      651KB

      MD5

      b181beaba4204ac3ce7bc8e6f0b74312

      SHA1

      4ab13763d2ecdf0968f15a39302aab2b1f0ab462

      SHA256

      f36bad234fd1599dd1398d20bc57499314fe96d5de20074536067b2d3c2b4f2d

      SHA512

      d1aaa2fd25e53986c8ea8213a8a02515927c9e9aa3e4d8077a138a29ba32c807ec81473b672a22ffb6ba26126ccd7e1d310e057ef964d3b21b1672a67af5fd7b

    • C:\Windows\SysWOW64\28463\key.bin

      Filesize

      105B

      MD5

      27c90d4d9b049f4cd00f32ed1d2e5baf

      SHA1

      338a3ea8f1e929d8916ece9b6e91e697eb562550

      SHA256

      172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb

      SHA512

      d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae

    • memory/3512-35-0x0000000003230000-0x0000000003231000-memory.dmp

      Filesize

      4KB

    • memory/3512-34-0x00000000005C0000-0x00000000005C1000-memory.dmp

      Filesize

      4KB

    • memory/3512-28-0x0000000000B20000-0x0000000000B21000-memory.dmp

      Filesize

      4KB

    • memory/3512-27-0x0000000000B60000-0x0000000000B61000-memory.dmp

      Filesize

      4KB

    • memory/3512-26-0x0000000000B40000-0x0000000000B41000-memory.dmp

      Filesize

      4KB

    • memory/3512-25-0x0000000000B50000-0x0000000000B51000-memory.dmp

      Filesize

      4KB

    • memory/3512-24-0x0000000000B00000-0x0000000000B01000-memory.dmp

      Filesize

      4KB

    • memory/3512-31-0x0000000003210000-0x0000000003213000-memory.dmp

      Filesize

      12KB

    • memory/3512-36-0x00000000006B0000-0x00000000006B1000-memory.dmp

      Filesize

      4KB

    • memory/3512-32-0x0000000003260000-0x0000000003261000-memory.dmp

      Filesize

      4KB

    • memory/3512-29-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

      Filesize

      4KB

    • memory/3512-30-0x0000000003220000-0x0000000003221000-memory.dmp

      Filesize

      4KB

    • memory/3512-37-0x0000000003270000-0x0000000003271000-memory.dmp

      Filesize

      4KB

    • memory/3512-33-0x0000000003280000-0x0000000003281000-memory.dmp

      Filesize

      4KB

    • memory/3512-20-0x0000000000A20000-0x0000000000A7A000-memory.dmp

      Filesize

      360KB

    • memory/3512-19-0x0000000000400000-0x00000000004E0000-memory.dmp

      Filesize

      896KB

    • memory/3512-45-0x0000000000400000-0x00000000004E0000-memory.dmp

      Filesize

      896KB

    • memory/3512-46-0x0000000000A20000-0x0000000000A7A000-memory.dmp

      Filesize

      360KB

    • memory/3512-47-0x0000000003260000-0x0000000003261000-memory.dmp

      Filesize

      4KB

    • memory/3512-51-0x0000000000400000-0x00000000004E0000-memory.dmp

      Filesize

      896KB

    • memory/3512-57-0x0000000000400000-0x00000000004E0000-memory.dmp

      Filesize

      896KB

    • memory/3512-56-0x0000000000A20000-0x0000000000A7A000-memory.dmp

      Filesize

      360KB