Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23/10/2024, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe
-
Size
806KB
-
MD5
6f7708a440a47ce2491ae97e6f85bfcc
-
SHA1
6817471fa80703f6e87f0cdf5a977730966ebb52
-
SHA256
dcbc1479ff0f0dc4eeb8ced0237c18042f0b0396fe4c4de74336ed1e9fa2c3a2
-
SHA512
44e0ecff21522394103964542a3f217d65ca814ee8da104d96f42cdd3a3f9525c40f2c37026809825eef4b43380e0fba6b3971d0bffb6c19d1990925d3d842ee
-
SSDEEP
12288:5xAveq3DxzlsUjbnoUi+zpKWGbOwj0Slh+mViKTitwR18XDTpySdT:/9AJWAbdJLGbOwjUKTyDsSdT
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x00050000000197aa-43.dat family_ardamax -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 26229.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 26229.exe -
Executes dropped EXE 4 IoCs
pid Process 2748 26229.exe 2824 Exporer32.exe 2612 msnmgs.exe 2184 MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe -
Loads dropped DLL 11 IoCs
pid Process 2748 26229.exe 2748 26229.exe 2824 Exporer32.exe 2824 Exporer32.exe 2824 Exporer32.exe 2824 Exporer32.exe 2184 MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe 2184 MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe 2184 MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe 2612 msnmgs.exe 2612 msnmgs.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\Sys\msnmgs.exe Exporer32.exe File opened for modification C:\Windows\SysWOW64\Sys msnmgs.exe File created C:\Windows\SysWOW64\Sys\msnmgs.009 msnmgs.exe File opened for modification C:\Windows\SysWOW64\Sys\msnmgs.009 msnmgs.exe File created C:\Windows\SysWOW64\Sys\msnmgs.001 Exporer32.exe File created C:\Windows\SysWOW64\Sys\msnmgs.006 Exporer32.exe File created C:\Windows\SysWOW64\Sys\msnmgs.007 Exporer32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\26229.exe 6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe File opened for modification C:\Windows\26229.exe 26229.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msnmgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exporer32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ = "%SystemRoot%\\SysWow64\\NaturalLanguage6.dll" 26229.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32\ThreadingModel = "Both" 26229.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA} 26229.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\InprocServer32 26229.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2748 26229.exe Token: SeIncBasePriorityPrivilege 2748 26229.exe Token: 33 2612 msnmgs.exe Token: SeIncBasePriorityPrivilege 2612 msnmgs.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2748 26229.exe 2612 msnmgs.exe 2612 msnmgs.exe 2612 msnmgs.exe 2612 msnmgs.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2748 2656 6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe 30 PID 2656 wrote to memory of 2748 2656 6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe 30 PID 2656 wrote to memory of 2748 2656 6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe 30 PID 2656 wrote to memory of 2748 2656 6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe 30 PID 2748 wrote to memory of 2824 2748 26229.exe 31 PID 2748 wrote to memory of 2824 2748 26229.exe 31 PID 2748 wrote to memory of 2824 2748 26229.exe 31 PID 2748 wrote to memory of 2824 2748 26229.exe 31 PID 2824 wrote to memory of 2612 2824 Exporer32.exe 32 PID 2824 wrote to memory of 2612 2824 Exporer32.exe 32 PID 2824 wrote to memory of 2612 2824 Exporer32.exe 32 PID 2824 wrote to memory of 2612 2824 Exporer32.exe 32 PID 2824 wrote to memory of 2184 2824 Exporer32.exe 33 PID 2824 wrote to memory of 2184 2824 Exporer32.exe 33 PID 2824 wrote to memory of 2184 2824 Exporer32.exe 33 PID 2824 wrote to memory of 2184 2824 Exporer32.exe 33 PID 2824 wrote to memory of 2184 2824 Exporer32.exe 33 PID 2824 wrote to memory of 2184 2824 Exporer32.exe 33 PID 2824 wrote to memory of 2184 2824 Exporer32.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6f7708a440a47ce2491ae97e6f85bfcc_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\26229.exeC:\Windows\26229.exe2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Sys\msnmgs.exe"C:\Windows\system32\Sys\msnmgs.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe"C:\Users\Admin\AppData\Local\Temp\MapleStory.exe21_F99C54274D7843E2B97EF4C4E622D612.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2184
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
772KB
MD5011b0fcb7ad7dc56778f6da8fd737f57
SHA1bc8d23305cf89407b4871ca4a7f33e59a70d74d6
SHA256457f2fa951239f0a9c6801ec3b5493dffd1edd2181d226784a9d147432e69b2c
SHA5125c0881483ba3f8b94de1005dfcb777fd8171a3642094dfa476eb8540f0fc16cace3c01dd21280c37cbc10d0690279904cc1646c8d1c850be126529194dfa79f5
-
Filesize
3KB
MD5de670fd93381c051d7e51efa9cd22ce3
SHA188810c29d1d7e95e8c074a30f9c647fedbcf55c4
SHA256b1257eb005c017d2779dfe42d1d45894c11fece9ef547d52bffa20e4eff76e5b
SHA5120999f495cb22581ddb14c0c020ca22c9bb92cdae34d0a604c086ab4fea426903f99f8dcb145c91af648629649b0247b92f1a53ebfe777090580aa79758fa17f5
-
Filesize
5KB
MD5ff2bc313174a6ccfe1e0b5b1a58f0f49
SHA14e983cdee788faf6a13a9d5bf3f00f4a17dd6e8e
SHA256f212c83897599d81f4010f1ef3a43e5709e874912072d38d26a5ef5644462318
SHA512418083066ba5505267f4de91c9e439674e02645c430360dae22dfc390c33b4e0c01857634d1dcb5dc298c296a5f4130397388bceee2ad82ba0a711ab56d1bd0f
-
Filesize
4KB
MD550c8c542dca77df82f5925b145567611
SHA164bdce386146e3548d3d85cf16fdd0d34cbafe2f
SHA2560692f76ec589e517f0a5205e658ca44656322c0382cee2af53890324818b3e0f
SHA512f7df5e9ac0c81f832e8dfe882eb1c4746f30131bef5a56947634146c813df079acd57b3fc954254684c6f4ef291802cd9629e6af3ced9be1f381fdd858a327c2
-
Filesize
459KB
MD54db1b69341dc88b901d85be34278a634
SHA10d55d2852a58b597c96c1dcec25efc961d882ba1
SHA256c3f29e3f8b9eb7c20a0046fc105d2199dc5327a570e8c76908e44be1200fb893
SHA512e11ee43c65179a562254cc63fda5c25ae228603bd88fd357faea2a5b49b4df11dfde5efe46544ac138d008cdffc419c793b35781ef201a9462a9eda30b52dee0
-
Filesize
4KB
MD5a9680f653434b4766fdc2a3c592af879
SHA1fd8e999c43fa83df3144aa5bbaae73bac3834296
SHA25630e084f531980a35b79dd36ac9ee0022d0aba792da99b3d71eea26d327db9ad3
SHA512685fe7bbaf9fe5d140f07e9fe0f1eff0cecf8a3a4d050fe917ce8eddac3394ab7b8cea575e2d6f3dace309716662fbb5a9016850b120ea2099a00cfc848f57ac
-
Filesize
297KB
MD57182d545f06c3bdc69934a83869a46c1
SHA18e91a1199713af4f51fc89048cbfbbbeaac3bd95
SHA256afbb631ba2eb70c5acf3e9a6d1cc16ea3a7f8a640803534cfdd15287ed507054
SHA512a5ac7055bd2de1d0594a4bc60401e90ac36000d928bf445516f42842d20065ceb49f8716974b03e3e9536d291a10e47efc8129c701676fc05994437fbdccee90
-
Filesize
44KB
MD5b69b06a60969c86eebb4c573d849650b
SHA112aea6493497951573fce2dd9fd0f7be022fe748
SHA2566f44097a8498624fce354be29ff4d3e35c5ced3b129c33cf9436903cb1c2e368
SHA5123d5ac6fe1d9364715458353f2274b897769affcd5abc420cc44133cba51f646a6a754bdac10626e99978345e66e3966ff6b9c9c63373d1b2046995a59ca0533e