Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2024, 10:03
Static task
static1
Behavioral task
behavioral1
Sample
7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe
-
Size
291KB
-
MD5
7ebc7e32892eeed05f6306d0e98c2bc4
-
SHA1
1b9f6af255278a2ae5f624ce4659318801f5598a
-
SHA256
021af6a0222c54d8ade50258753b1d0ffdc03c4499f1b1d185611b4285b78f30
-
SHA512
22c9fa5144c46f18074c4c68299fc41642601d727cae1fa61962cdfe4315d5d751eb5e350f39b1ee4b131d798fe1df5da9b542b644ae3724399a3ee55d759ced
-
SSDEEP
6144:WVwdcnGb45Teu+aK+82FziOfG3sLbcZpjwYDnHFhyYQ:EwdcnQJu/X82sOfG3sLbcZuYLHFhw
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b84-22.dat family_ardamax -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 1.exe -
Executes dropped EXE 3 IoCs
pid Process 3652 1.exe 2588 XPUQ.exe 4852 Auto-Clicker.exe -
Loads dropped DLL 7 IoCs
pid Process 3652 1.exe 2588 XPUQ.exe 4852 Auto-Clicker.exe 2588 XPUQ.exe 2588 XPUQ.exe 4852 Auto-Clicker.exe 4852 Auto-Clicker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XPUQ Agent = "C:\\Windows\\SysWOW64\\28463\\XPUQ.exe" XPUQ.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\XPUQ.001 1.exe File created C:\Windows\SysWOW64\28463\XPUQ.006 1.exe File created C:\Windows\SysWOW64\28463\XPUQ.007 1.exe File created C:\Windows\SysWOW64\28463\XPUQ.exe 1.exe File opened for modification C:\Windows\SysWOW64\28463 XPUQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Auto-Clicker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2588 XPUQ.exe Token: SeIncBasePriorityPrivilege 2588 XPUQ.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2800 7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe 4852 Auto-Clicker.exe 2588 XPUQ.exe 2588 XPUQ.exe 2588 XPUQ.exe 2588 XPUQ.exe 2588 XPUQ.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2800 wrote to memory of 3652 2800 7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe 91 PID 2800 wrote to memory of 3652 2800 7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe 91 PID 2800 wrote to memory of 3652 2800 7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe 91 PID 3652 wrote to memory of 2588 3652 1.exe 92 PID 3652 wrote to memory of 2588 3652 1.exe 92 PID 3652 wrote to memory of 2588 3652 1.exe 92 PID 3652 wrote to memory of 4852 3652 1.exe 93 PID 3652 wrote to memory of 4852 3652 1.exe 93 PID 3652 wrote to memory of 4852 3652 1.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7ebc7e32892eeed05f6306d0e98c2bc4_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\28463\XPUQ.exe"C:\Windows\system32\28463\XPUQ.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
C:\Users\Admin\AppData\Local\Temp\Auto-Clicker.exe"C:\Users\Admin\AppData\Local\Temp\Auto-Clicker.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275KB
MD5bfd8aa2dd040298b238434c522353537
SHA15ea0219ea918dc53788a2ca60983f7d4818bbb22
SHA25646df40f2587e28e396fbe24c1eb2322d7a7576b1fc7d8289573faab2cd80e80a
SHA5120de697ddfc245dd35ffa06dd73e8bff163a3ee1e93bcc5b5751d27f841544ce8ba3f51b8962c9444acb30d03d5437d26d0c05a3dec6b46cb6d69bb1e3e003f06
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
20KB
MD5e71fa30174985b7707bfb1abf47f7225
SHA1258e33d24633d0a9405360fb6daa2d5e67c71dd3
SHA25681aaeca5ea3daf029446010a2fb8b49efd4fd00f21fca664979c1ae6faa26650
SHA512f4bd4dcd998bdf2e16904d682a64c8e01894a5254f33a9a01051d40fbfa62a6b7b4cea9ff7b18d99ccfa771bd628f473868dc5ecd36cb5a6547db9103c0502f5
-
Filesize
440B
MD5dfc8b90ab515f20ee7968780c20c9701
SHA1043c73fd5d4faf5a932430c4f2b67a9b2cba46fc
SHA2567652df64ab3f396ab491f65c03c4598ad166476338132b0d036c19f0c56eb775
SHA5127be4858a5e5eb17e58c65a53985b44894bf3273975dad865a2260da4d831c05243d77c17e697c210811894ed613c2b578ab9189299b30c8bb058929b8820a7ec
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8