Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0bee675df944e69e825f221df5e62834_JaffaCakes118.exe
-
Size
1020KB
-
MD5
0bee675df944e69e825f221df5e62834
-
SHA1
6278d31dcaa50685f8e607498cc105b6140bdfa6
-
SHA256
df4fa7c74f5302285b9458974e06d07de65cb625bcecbc063fe9f6a927ca68da
-
SHA512
3b0958ee54007d3e15139588b035c3018f030d347ba2cb424765a0f56df8c0dd1a5a46336cbdcc2a0c91298a7740b7df4601c19e58197fae2d0c94e7a1ae91fa
-
SSDEEP
24576:xUFYB1OlMu9k2vwKhKKXd5rCDOzB9iKq8JIBfD2VdpUncPuhS/:xt1O2BKlRzCDIB9iKq8SBC3pOcF/
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x00050000000195d6-37.dat family_ardamax -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 2932 Exporer32.exe 2576 KWVE.exe -
Loads dropped DLL 12 IoCs
pid Process 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2932 Exporer32.exe 2932 Exporer32.exe 2932 Exporer32.exe 2576 KWVE.exe 2576 KWVE.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2052 DllHost.exe 2052 DllHost.exe 2932 Exporer32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KWVE Agent = "C:\\Windows\\SysWOW64\\28463\\KWVE.exe" KWVE.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\KWVE.001 Exporer32.exe File created C:\Windows\SysWOW64\28463\KWVE.006 Exporer32.exe File created C:\Windows\SysWOW64\28463\KWVE.007 Exporer32.exe File created C:\Windows\SysWOW64\28463\KWVE.exe Exporer32.exe File created C:\Windows\SysWOW64\28463\AKV.exe Exporer32.exe File opened for modification C:\Windows\SysWOW64\28463 KWVE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exporer32.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ = "%CommonProgramFiles(x86)%\\Microsoft Shared\\DAO\\dao360.dll" 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\Class = "dao.TableDefClass" 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\RuntimeVersion = "v1.0.3705" 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ThreadingModel = "Apartment" 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA} 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ = "DAO.TableDef.36" 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\Assembly = "dao, Version=10.0.4504.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ProgID\ = "DAO.TableDef.36" 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: 33 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe Token: 33 2576 KWVE.exe Token: SeIncBasePriorityPrivilege 2576 KWVE.exe Token: SeIncBasePriorityPrivilege 2576 KWVE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2052 DllHost.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 2576 KWVE.exe 2576 KWVE.exe 2576 KWVE.exe 2576 KWVE.exe 2576 KWVE.exe 2052 DllHost.exe 2052 DllHost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2932 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 30 PID 2216 wrote to memory of 2932 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 30 PID 2216 wrote to memory of 2932 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 30 PID 2216 wrote to memory of 2932 2216 0bee675df944e69e825f221df5e62834_JaffaCakes118.exe 30 PID 2932 wrote to memory of 2576 2932 Exporer32.exe 31 PID 2932 wrote to memory of 2576 2932 Exporer32.exe 31 PID 2932 wrote to memory of 2576 2932 Exporer32.exe 31 PID 2932 wrote to memory of 2576 2932 Exporer32.exe 31 PID 2576 wrote to memory of 2812 2576 KWVE.exe 33 PID 2576 wrote to memory of 2812 2576 KWVE.exe 33 PID 2576 wrote to memory of 2812 2576 KWVE.exe 33 PID 2576 wrote to memory of 2812 2576 KWVE.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bee675df944e69e825f221df5e62834_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0bee675df944e69e825f221df5e62834_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\28463\KWVE.exe"C:\Windows\system32\28463\KWVE.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\KWVE.exe > nul4⤵
- System Location Discovery: System Language Discovery
PID:2812
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD519d5ed881fafebf3347a356274c1e496
SHA12053ce37c39cee360b4b8a042ddc6f0ea0843ef6
SHA2562ceaabe5176c0fbca94342fd718cfcaf0f065419f4f3ab584dc09a86026f555f
SHA512046170fd068f7c8fc200b80795621d6d00b40bdb48828ba502c9cc496868632a87929794f559c836f13d4121aaeaa1c8259231499b33f1c4af204175c30dcabd
-
Filesize
395KB
MD5adbec81b510dcfe49835f95940ef961d
SHA177940f6e46fbd5f53de23bd49afe9172470769d0
SHA256466efb4b00255f21075b340fc2d2444f182947ab90270840543658c5fd3a9b95
SHA512ef4324a06fbe960933f5551ea6ac587cd87cb6025bc6879a2b81a4d1033cfe87e244b6a87fb5db5ad065321ccbe8035cf24a668452d5b0c6a4063a355a12b2a7
-
Filesize
450B
MD5c09bc97f8d66c59a1bb8b14707e4399c
SHA184c6ae17f87424e3f07c4af979964cde6d16d343
SHA256661ab56e7de6dbaba82919f57be250bcd0149d08207cbccd57f50be4f0d2d62f
SHA512c4c508791f211f7bbed790ffa149e3e6d81fe7980366a898b8c9fe7fbb40d8ad67f2cee68bf624899dc00174aedea30c77ff901e74467f43bdbbf6fbece1e054
-
Filesize
473KB
MD53c90d45b1c004e86a7f7a7a340f1abc8
SHA110602c450bcbda2735dc036f2e399646f0c64f4c
SHA256f6d9c3bba7fc4dfa681cadf68f41093e3c431501c6789e891e599719e5d2781c
SHA51285457be4c2aa76ede288cd185131d46e5f0b37187313f3a54fe789e28929ec6e44282f4ba0981f46354705cd5da83990586c8846f52fcdb807908254c8719cc1
-
Filesize
4KB
MD513e10cd76f11d6cb43182dcba7370171
SHA1e6b8ce329e49ff09f1cb529c60fc466cb9a579c8
SHA256f1265c88f0077009eaa18db413f156cc7ad8d41dc9d797dd1032b0e0ae9c40d5
SHA512ee32ef3f50838936417e51dfd365b166456900e327dbe51902700bb3d562dea22e6fbd9009c822ba0562687001802a2e61d38123f81ae19f7b3d05bb1fd5cda8
-
Filesize
507KB
MD5a5f7f3556110e2f9e19d537aea8a10be
SHA126d7fef9f3c6bee6539a4717f6d5989608727568
SHA25671907e7cd27b2925e0a8288173e2271fd9974d45fd5294dac9e4cb4686f4523f
SHA512ae68338dda0d29e6da3db95291a6060f50d6a8fb103e35ce42fd3c1fe2d2fd193b215d1c3a7fdd04578b80bd36c52b986ecf7ab2948d7bbe926853969e41b2e1
-
Filesize
8KB
MD5f5eff4f716427529b003207d5c953df5
SHA179696d6c8d67669ea690d240ef8978672e3d151c
SHA256ac54ebb9eec3212f294462ce012fdc42f4b0896d785d776a5a2cc3599dc5bcde
SHA5125a48599a5855f06c3e7d6f89c4e06bab1f4381b9d30cf3824c465b8fd6c142b316e6bd6aaad73d1f9b3e84d96113fb5e7374831bf503744013c9e1a0632a0caf
-
Filesize
5KB
MD5bc75eddaa64823014fef0fe70bd34ffc
SHA115cd2ace3b68257faed33c78b794b2333eab7c0a
SHA2569eada36d17635bedb85ce96a62cb019dbfee696b9986f69de7d5b5bc1f44df5d
SHA51220db25f32f9cfdbffa4f30c0065125052c6e20b7dcc147fa7ebff38e37b51f6a43e48e486f148d7ee11671479b9fb0bbe1c6df151101af3b50c65fd334d13baa