Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2024, 06:08

General

  • Target

    60bce0bee7741fbf29f5eea7d7f973d7_JaffaCakes118.exe

  • Size

    312KB

  • MD5

    60bce0bee7741fbf29f5eea7d7f973d7

  • SHA1

    64ee700edcbca3929ab00d707499dbc5816d0c50

  • SHA256

    1ec09f094dfa532f11912d0f5f8cccefaf1c22f308b4cc2fad7b3529924d53e8

  • SHA512

    8331c211c659f8aecb0d832704650fdac72bc03badb816652a4fb3099f66f2877635238090b517f7cd0544804c360158d181a0f7aa6508d20620d792ee8415a7

  • SSDEEP

    6144:rRXe6tcdVdZnff0NpDMCtazKxLd6qUo1msiJL6xDzGCB7l+7wE9VG81cb1DASaXW:rRXebdZngpDM8a+S0MVJWvG6Zhv81G1x

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60bce0bee7741fbf29f5eea7d7f973d7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\60bce0bee7741fbf29f5eea7d7f973d7_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Windows\SysWOW64\Sys32\CGGS.exe
      "C:\Windows\system32\Sys32\CGGS.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2104
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\kankamfi0.jpg

    Filesize

    37KB

    MD5

    7646da930400b70e6cf3588aa7e76505

    SHA1

    a1eb371230b7dd9f79cd68a6d34033b89ede8737

    SHA256

    91ac41df52eadae97fce7aef46f92f4e398ce20512aac87df8734b17b7893146

    SHA512

    9ac705e32adf3cbb825bda17ecd2ccc50b8345c7343d8c82af3d7901087a4a47535b165a522c81111341eb6fa33713a9c38a2777367b55e0a18376fbb066eb4d

  • C:\Windows\SysWOW64\Sys32\CGGS.001

    Filesize

    388B

    MD5

    6d4f9abcc893481498d9d05be370fd03

    SHA1

    7b3314753056eb9b011faa952311c60cc5f7bf72

    SHA256

    87188c82f83402b7711925fd4b8b6c865cc5e97ac80a302cd5c195426eae9541

    SHA512

    e2b74f7d54bad9b72068165d4cea3936caf8d60ff0438633be7cbb54b9f517252c122505daf81fd50c9097c6be8f1dd3fa4d2124899a4133d510e97bbefeb8e8

  • C:\Windows\SysWOW64\Sys32\CGGS.006

    Filesize

    7KB

    MD5

    928cc65dc793834c709a054ca57c19c8

    SHA1

    a1e5d8407199c1bd6a4b274044de640fe0d9e99b

    SHA256

    e3473d81a02ed30e4236591384136f41f17b6a4aae24b5468789644ccd4bf192

    SHA512

    f7c8f7a75c4f8a418630e2ac15676740a902449d9a3c4baf3184409f8701c9caa3e82304d141362d95503f1af6b693eed7b77f690d92ca0162f7ea3ecbc80fdf

  • C:\Windows\SysWOW64\Sys32\CGGS.007

    Filesize

    5KB

    MD5

    3e1f5d5a06cf97b0495b8d129fbe02e4

    SHA1

    b0de258a813f5edde85004f6865b6ed91f6d6f8f

    SHA256

    f49448fc7c567e64eaeb9cc4dbd3c8021a82b5d9df0a622a439f7b42dc2f26d7

    SHA512

    b0e0b81cb5776d298e96346aa61027c9799a47191c94de50be2209c32747774959d002ddeb98fd15556ee893b0d7bd1f0c8a901469dce4e3acf94e2c4c3e2bfd

  • \Users\Admin\AppData\Local\Temp\@9CFB.tmp

    Filesize

    4KB

    MD5

    33303ca8abef9221cb410b8a232e9fe4

    SHA1

    0cdfc25dbf0e9ad7d4585cd9037dc2e6604be00c

    SHA256

    5110301dee966f0f26307ab1b430279d1e4999c2c4a0ea924ff32f1a9ded869a

    SHA512

    da29821045773ba776def985966b62e09e69bb5bf1786b16c2fff6feb68a03b9e22c5f7d081e3dd58d1785cd7ac64736497c043b7cf6c7149c3a54f8ef111800

  • \Windows\SysWOW64\Sys32\CGGS.exe

    Filesize

    476KB

    MD5

    ef52b540cb404d908338e9cbf7cff283

    SHA1

    778765e1736c0a197685978c3fee7a44e7bde419

    SHA256

    39d8bdb975fbfcbcec8fe63be4e9fe6ce39ae5d23a005118aeffa07b17a3f815

    SHA512

    596b77bf5b15455c326a5a2efd66bc69685eb625e3e211ea0341ad4d8920ada7618a7107e42f2c0963fe6c2d92f2acf47b641ef33071a7c42004e5874d5219a6

  • memory/2104-21-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2104-30-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2504-25-0x0000000003160000-0x0000000003162000-memory.dmp

    Filesize

    8KB

  • memory/2756-26-0x00000000000B0000-0x00000000000B2000-memory.dmp

    Filesize

    8KB