Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
28a5f2c51c56b0823b7af08f7d4ed0f1
-
SHA1
ba3d13e8035cd8f587029ca8f0fa1f21a1ce5183
-
SHA256
baa98600745dc07ae41639a873f63c849dc0594ae66db9e212abfb5799b85ede
-
SHA512
67f15b634cc1c8f95a3ded29a24124ee3e6a771e25a4192831be936d53c26b056f83cd49fcf12417209a7bcfac2b202ffd699c61ddeab926223010d09cd61371
-
SSDEEP
24576:iITTqxWJhhL6GjT46OxDcTTETBiXbj06blqb7D49Dktpla:i6TqxWJLGGI6OxDYSYQ6pEkQ
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b9c-8.dat family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3628 IQN.exe -
Loads dropped DLL 2 IoCs
pid Process 3628 IQN.exe 3544 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IQN Start = "C:\\Windows\\SysWOW64\\HYNHNF\\IQN.exe" IQN.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\HYNHNF\IQN.008 IQN.exe File opened for modification C:\Windows\SysWOW64\HYNHNF\IQN.008 IQN.exe File created C:\Windows\SysWOW64\HYNHNF\IQN.004 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\HYNHNF\IQN.001 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\HYNHNF\IQN.002 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\HYNHNF\AKV.exe 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\HYNHNF\IQN.exe 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\HYNHNF\ IQN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3628 IQN.exe 3628 IQN.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3628 IQN.exe Token: SeIncBasePriorityPrivilege 3628 IQN.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3628 IQN.exe 3628 IQN.exe 3628 IQN.exe 3628 IQN.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3544 wrote to memory of 3628 3544 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe 87 PID 3544 wrote to memory of 3628 3544 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe 87 PID 3544 wrote to memory of 3628 3544 28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\28a5f2c51c56b0823b7af08f7d4ed0f1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\HYNHNF\IQN.exe"C:\Windows\system32\HYNHNF\IQN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
490KB
MD521f362e0d289ba822e526fced424c1f2
SHA121118c5c57264eb48a0fde577ec06d4cb07a404c
SHA2567c561dea779006b50d5befeef48a965dbef1c3b807983bb6411adf27a8c87779
SHA512349459969f00fc06e5cc9479d1e0860b371170ac787bcab03c46e27d3bec7f909d22c8ee76d3e6f75e43a8f73a074a8cf3021a87a86fedcc7af611ea41346399
-
Filesize
61KB
MD593c2eac6b4d476a04730266ec1523f8a
SHA1d53544650a95769d90c89fa90039399cb8d7e054
SHA256898d4ed4dc6b52db670bf57bd859ae6e1c25230b28a69e7d0e548bae6941cba8
SHA5129dc516552c08af9600ebabb025bfed1b9a8f16aafbf1cb7530af7254847264399a118a3bbf980e54ad01542fb4c0df55699d207ac44d85bd0eb94067b1a0bae0
-
Filesize
44KB
MD592fc2d978e3dcc66dbbe6ddde516dd75
SHA12e31d1a209193872fc7f494274b17f582bb137c0
SHA256a89bebf2e88c1055b1d38bb715a7efeef93c18d5ec1d32a171ae354ccba4087c
SHA51250d859f3abaf2d2bcf563a0bf0f47b3be0d1ea0f345fc69f5c9a3635d359798c068e4516803c7b8bd0a61b01b3bb1ece0a4703a278144acfa877311317a959ba
-
Filesize
1KB
MD5ee58cfa0c48494ed6ddf561b720b91ce
SHA173862c6327c13b87a655e71ac791f64989f24d88
SHA2562509baafbcd6863c7583882b83a54f354b7c91e2e43f63b5890f170def49ea4a
SHA512cad365f8f907a4a4faf1102138b5bc7682a732bb184e160b3bd20ca1ee45e82371321d7e1b94c4bc5b47948b71245c0cef5e02313065a0c33c10d2554609bc87
-
Filesize
327B
MD5c99423725ac836225ca0a55837d9f9fd
SHA13afdd851928897fb0eb845f89bb2253b5ed8d609
SHA256bf51b70e30987ab1cbd4da81901c4392bf74b1b0ab4e81480d14a91b37b8c497
SHA51224e4ca3b659c2c9a4d12cee06946be13908c939bf9c66f1fb442fd2c439d0e557c689654fd818d013538c5b721fb5a307a4449533bcfaef5daf1ce0e2e26e3ec
-
Filesize
1.7MB
MD5851f20b20b52b01ee3e1000c89b47c93
SHA1f46b94a834d6ba980b096747d725bd975d5d0dbc
SHA25610b92386e4d23ae4fecbe8f5114bf494cf6012d379a1dd694b5130d5900e7651
SHA5120eedbd7be28f504c87308552c780b9597d19b9cf220e3995f0d6f351ce21cf2a16f9969d4ed22170151373b5e0c8b9fa62b5b3feb7ecf335606d5d0e7ca6761e