Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2024, 18:12

General

  • Target

    0bee675df944e69e825f221df5e62834_JaffaCakes118.exe

  • Size

    1020KB

  • MD5

    0bee675df944e69e825f221df5e62834

  • SHA1

    6278d31dcaa50685f8e607498cc105b6140bdfa6

  • SHA256

    df4fa7c74f5302285b9458974e06d07de65cb625bcecbc063fe9f6a927ca68da

  • SHA512

    3b0958ee54007d3e15139588b035c3018f030d347ba2cb424765a0f56df8c0dd1a5a46336cbdcc2a0c91298a7740b7df4601c19e58197fae2d0c94e7a1ae91fa

  • SSDEEP

    24576:xUFYB1OlMu9k2vwKhKKXd5rCDOzB9iKq8JIBfD2VdpUncPuhS/:xt1O2BKlRzCDIB9iKq8SBC3pOcF/

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0bee675df944e69e825f221df5e62834_JaffaCakes118.exe"
    1⤵
    • Checks BIOS information in registry
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
      "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\SysWOW64\28463\KWVE.exe
        "C:\Windows\system32\28463\KWVE.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\KWVE.exe > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2812
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\laundry_007.jpg

    Filesize

    26KB

    MD5

    19d5ed881fafebf3347a356274c1e496

    SHA1

    2053ce37c39cee360b4b8a042ddc6f0ea0843ef6

    SHA256

    2ceaabe5176c0fbca94342fd718cfcaf0f065419f4f3ab584dc09a86026f555f

    SHA512

    046170fd068f7c8fc200b80795621d6d00b40bdb48828ba502c9cc496868632a87929794f559c836f13d4121aaeaa1c8259231499b33f1c4af204175c30dcabd

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    395KB

    MD5

    adbec81b510dcfe49835f95940ef961d

    SHA1

    77940f6e46fbd5f53de23bd49afe9172470769d0

    SHA256

    466efb4b00255f21075b340fc2d2444f182947ab90270840543658c5fd3a9b95

    SHA512

    ef4324a06fbe960933f5551ea6ac587cd87cb6025bc6879a2b81a4d1033cfe87e244b6a87fb5db5ad065321ccbe8035cf24a668452d5b0c6a4063a355a12b2a7

  • C:\Windows\SysWOW64\28463\KWVE.001

    Filesize

    450B

    MD5

    c09bc97f8d66c59a1bb8b14707e4399c

    SHA1

    84c6ae17f87424e3f07c4af979964cde6d16d343

    SHA256

    661ab56e7de6dbaba82919f57be250bcd0149d08207cbccd57f50be4f0d2d62f

    SHA512

    c4c508791f211f7bbed790ffa149e3e6d81fe7980366a898b8c9fe7fbb40d8ad67f2cee68bf624899dc00174aedea30c77ff901e74467f43bdbbf6fbece1e054

  • C:\Windows\SysWOW64\28463\KWVE.exe

    Filesize

    473KB

    MD5

    3c90d45b1c004e86a7f7a7a340f1abc8

    SHA1

    10602c450bcbda2735dc036f2e399646f0c64f4c

    SHA256

    f6d9c3bba7fc4dfa681cadf68f41093e3c431501c6789e891e599719e5d2781c

    SHA512

    85457be4c2aa76ede288cd185131d46e5f0b37187313f3a54fe789e28929ec6e44282f4ba0981f46354705cd5da83990586c8846f52fcdb807908254c8719cc1

  • \Users\Admin\AppData\Local\Temp\@7ADB.tmp

    Filesize

    4KB

    MD5

    13e10cd76f11d6cb43182dcba7370171

    SHA1

    e6b8ce329e49ff09f1cb529c60fc466cb9a579c8

    SHA256

    f1265c88f0077009eaa18db413f156cc7ad8d41dc9d797dd1032b0e0ae9c40d5

    SHA512

    ee32ef3f50838936417e51dfd365b166456900e327dbe51902700bb3d562dea22e6fbd9009c822ba0562687001802a2e61d38123f81ae19f7b3d05bb1fd5cda8

  • \Users\Admin\AppData\Local\Temp\Exporer32.exe

    Filesize

    507KB

    MD5

    a5f7f3556110e2f9e19d537aea8a10be

    SHA1

    26d7fef9f3c6bee6539a4717f6d5989608727568

    SHA256

    71907e7cd27b2925e0a8288173e2271fd9974d45fd5294dac9e4cb4686f4523f

    SHA512

    ae68338dda0d29e6da3db95291a6060f50d6a8fb103e35ce42fd3c1fe2d2fd193b215d1c3a7fdd04578b80bd36c52b986ecf7ab2948d7bbe926853969e41b2e1

  • \Windows\SysWOW64\28463\KWVE.006

    Filesize

    8KB

    MD5

    f5eff4f716427529b003207d5c953df5

    SHA1

    79696d6c8d67669ea690d240ef8978672e3d151c

    SHA256

    ac54ebb9eec3212f294462ce012fdc42f4b0896d785d776a5a2cc3599dc5bcde

    SHA512

    5a48599a5855f06c3e7d6f89c4e06bab1f4381b9d30cf3824c465b8fd6c142b316e6bd6aaad73d1f9b3e84d96113fb5e7374831bf503744013c9e1a0632a0caf

  • \Windows\SysWOW64\28463\KWVE.007

    Filesize

    5KB

    MD5

    bc75eddaa64823014fef0fe70bd34ffc

    SHA1

    15cd2ace3b68257faed33c78b794b2333eab7c0a

    SHA256

    9eada36d17635bedb85ce96a62cb019dbfee696b9986f69de7d5b5bc1f44df5d

    SHA512

    20db25f32f9cfdbffa4f30c0065125052c6e20b7dcc147fa7ebff38e37b51f6a43e48e486f148d7ee11671479b9fb0bbe1c6df151101af3b50c65fd334d13baa

  • memory/2052-57-0x0000000000140000-0x0000000000142000-memory.dmp

    Filesize

    8KB

  • memory/2216-54-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/2216-0-0x0000000000550000-0x000000000059D000-memory.dmp

    Filesize

    308KB

  • memory/2216-6-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/2216-7-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/2216-53-0x0000000000550000-0x000000000059D000-memory.dmp

    Filesize

    308KB

  • memory/2216-45-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/2216-8-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/2216-9-0x0000000000550000-0x000000000059D000-memory.dmp

    Filesize

    308KB

  • memory/2216-5-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/2576-46-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2932-56-0x00000000005A0000-0x00000000005A2000-memory.dmp

    Filesize

    8KB