Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 01:46

General

  • Target

    28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    28a5f2c51c56b0823b7af08f7d4ed0f1

  • SHA1

    ba3d13e8035cd8f587029ca8f0fa1f21a1ce5183

  • SHA256

    baa98600745dc07ae41639a873f63c849dc0594ae66db9e212abfb5799b85ede

  • SHA512

    67f15b634cc1c8f95a3ded29a24124ee3e6a771e25a4192831be936d53c26b056f83cd49fcf12417209a7bcfac2b202ffd699c61ddeab926223010d09cd61371

  • SSDEEP

    24576:iITTqxWJhhL6GjT46OxDcTTETBiXbj06blqb7D49Dktpla:i6TqxWJLGGI6OxDYSYQ6pEkQ

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Windows\SysWOW64\HYNHNF\IQN.exe
      "C:\Windows\system32\HYNHNF\IQN.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\HYNHNF\AKV.exe

    Filesize

    490KB

    MD5

    21f362e0d289ba822e526fced424c1f2

    SHA1

    21118c5c57264eb48a0fde577ec06d4cb07a404c

    SHA256

    7c561dea779006b50d5befeef48a965dbef1c3b807983bb6411adf27a8c87779

    SHA512

    349459969f00fc06e5cc9479d1e0860b371170ac787bcab03c46e27d3bec7f909d22c8ee76d3e6f75e43a8f73a074a8cf3021a87a86fedcc7af611ea41346399

  • C:\Windows\SysWOW64\HYNHNF\IQN.001

    Filesize

    61KB

    MD5

    93c2eac6b4d476a04730266ec1523f8a

    SHA1

    d53544650a95769d90c89fa90039399cb8d7e054

    SHA256

    898d4ed4dc6b52db670bf57bd859ae6e1c25230b28a69e7d0e548bae6941cba8

    SHA512

    9dc516552c08af9600ebabb025bfed1b9a8f16aafbf1cb7530af7254847264399a118a3bbf980e54ad01542fb4c0df55699d207ac44d85bd0eb94067b1a0bae0

  • C:\Windows\SysWOW64\HYNHNF\IQN.002

    Filesize

    44KB

    MD5

    92fc2d978e3dcc66dbbe6ddde516dd75

    SHA1

    2e31d1a209193872fc7f494274b17f582bb137c0

    SHA256

    a89bebf2e88c1055b1d38bb715a7efeef93c18d5ec1d32a171ae354ccba4087c

    SHA512

    50d859f3abaf2d2bcf563a0bf0f47b3be0d1ea0f345fc69f5c9a3635d359798c068e4516803c7b8bd0a61b01b3bb1ece0a4703a278144acfa877311317a959ba

  • C:\Windows\SysWOW64\HYNHNF\IQN.004

    Filesize

    1KB

    MD5

    ee58cfa0c48494ed6ddf561b720b91ce

    SHA1

    73862c6327c13b87a655e71ac791f64989f24d88

    SHA256

    2509baafbcd6863c7583882b83a54f354b7c91e2e43f63b5890f170def49ea4a

    SHA512

    cad365f8f907a4a4faf1102138b5bc7682a732bb184e160b3bd20ca1ee45e82371321d7e1b94c4bc5b47948b71245c0cef5e02313065a0c33c10d2554609bc87

  • C:\Windows\SysWOW64\HYNHNF\IQN.008

    Filesize

    327B

    MD5

    c99423725ac836225ca0a55837d9f9fd

    SHA1

    3afdd851928897fb0eb845f89bb2253b5ed8d609

    SHA256

    bf51b70e30987ab1cbd4da81901c4392bf74b1b0ab4e81480d14a91b37b8c497

    SHA512

    24e4ca3b659c2c9a4d12cee06946be13908c939bf9c66f1fb442fd2c439d0e557c689654fd818d013538c5b721fb5a307a4449533bcfaef5daf1ce0e2e26e3ec

  • C:\Windows\SysWOW64\HYNHNF\IQN.exe

    Filesize

    1.7MB

    MD5

    851f20b20b52b01ee3e1000c89b47c93

    SHA1

    f46b94a834d6ba980b096747d725bd975d5d0dbc

    SHA256

    10b92386e4d23ae4fecbe8f5114bf494cf6012d379a1dd694b5130d5900e7651

    SHA512

    0eedbd7be28f504c87308552c780b9597d19b9cf220e3995f0d6f351ce21cf2a16f9969d4ed22170151373b5e0c8b9fa62b5b3feb7ecf335606d5d0e7ca6761e

  • memory/3628-17-0x0000000000780000-0x0000000000781000-memory.dmp

    Filesize

    4KB

  • memory/3628-24-0x0000000000780000-0x0000000000781000-memory.dmp

    Filesize

    4KB