Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/12/2024, 04:05
General
-
Target
e9cdf3dd25a6e8116699811b85eab09a_JaffaCakes118.exe
-
Size
807KB
-
MD5
e9cdf3dd25a6e8116699811b85eab09a
-
SHA1
54a64e4961c29ea81c3ce7ccf80ff84bb62cc6ae
-
SHA256
15005ef320ea86fb763689a3fcd28ba4f75c7ed72fba38f4dd3ac18bd3efc687
-
SHA512
639d728770df671c4780d631004d282705764bd8b2c5f33575171786ff9256efbb1b4f81a7ec61ed1b815eaf1235012adc7fe7d9a68fc3ce9b48cab0d017b4ea
-
SSDEEP
24576:OTV5ndLUZB/u3VVmpyMBoIxAzEV6JQi0cJUCjJD:QdiB2l0/BNxAYcScJUSt
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 34 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9cdf3dd25a6e8116699811b85eab09a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9cdf3dd25a6e8116699811b85eab09a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\CMJB.exe"C:\Windows\system32\28463\CMJB.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 11283⤵
- Loads dropped DLL
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\CMJB.exe > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Okuyun..txt2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1600 -ip 16001⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5cb07753c45624238b4403480372be5db
SHA110af5bfbed599165d996470278f011728e866df7
SHA25663c3ed8cbe11314a2f2cd6ff50305bad98075be9e09d22e45b47af557a3388e7
SHA5122c72cca45ef924104c6892dd96f2e27a5d43bacc9f3eb0eeee24c871cc1bd1642d77734822d9d934f93a77c884fa1c682cf1ceddffe157a613978d9edd184312
-
Filesize
81B
MD519b2c20900c4b2af43663d2bc42bf6eb
SHA1d50958be7e376036ea3bafc821c9c9f66f124b56
SHA2567eabb00ecd447344d54026a6faed91c6759647c098cb03144c806634958815cd
SHA5127d7c9f069fa3b0b3bf2cca4611f36dd78d048e8cda3b89359f1ebad7e20fd28825ef1ac2fcdeced2694a7d48e5a577f3d3aff9d1b72cb738ae1ec5b08e8b8300
-
Filesize
457KB
MD542e2202ac32edb39ccf9979515018d85
SHA1c1e07fbe2fa759e2775d4dcf7de23a66d2422a1a
SHA256367b4028baf3df4a5f77169bd64c9ef8fd7968a4d6c852ae3f81a726f4b37222
SHA512a97d9e968b1f63dedba74999aabe6fd150aae985c1143d29b183cc0d663a45252c57494c3457136c5e500050c6af6c819f9ba7070b7d62300ede2e9a7c792768
-
Filesize
440B
MD5f4325a6b407f5a44e46aaabaf5d86cbf
SHA1dcbeb464607e71049e86f2ae5726984b2db4a459
SHA2564a598cbd435123719e82e136216e1e43d4997d1f5ef8da12d163f85e87ca1cc4
SHA5121f73d17a83b942713c3838b7c71f73d3a9b1a7cb7970a35492e588399ad6ba7cf28da34d79791971084b81d63b2c1583f18d9f7b600fedd79a1c9fee95aa7a0f
-
Filesize
8KB
MD53da3041787b72a7909d9f6184ce6bc5e
SHA1fc7f00b8a1341b5341e2ba6f94ba85364bc90843
SHA25618e06896cc71e99b717cff8d68cba86fea3eba5087b93734f6418e53cadab5b3
SHA512150fa3f8eeec3621ac61eab0da3f2692dd776887ec0c1791404df3dd8784982563496e1e990217a99c4fd53c5d5d68e0574737879b72d78ab737033f1b08560a
-
Filesize
5KB
MD550d0bcf6b5a6b11d9e274ccefba3f02e
SHA157acf2a1236b7534f2db661a9d95aeadcd41aa2a
SHA256a5e5cf8b3133031f25db37fd13b029cdfc9d1588ca7f68041e52349f46cbbf5c
SHA512c0288f92c75f4a6ea45434e3960a3c5d8ed3d890121a3fd6da2449e1313db523224e301451d85a15ea8ee9b5c2fb3bf294ee90869a4d5608bcf48fa94458e938
-
Filesize
647KB
MD5a7b322839cedf8d56cb0a7dcdb50ab59
SHA1d27855e65f5d9e87666f39d2af694a0d75330a75
SHA256ba7362315c0608c9203c9d607fd85695fbc15f034ea40b3de7dd1abebd5859a3
SHA51286a416ae639ca458e56093d5c04f3406ac0389cf9a1047f714424ba89ffd047ca58e6927bc941d285d4db9e8a95e91e0d578be3038a83945b6af90586ea9f649
-
Filesize
105B
MD527c90d4d9b049f4cd00f32ed1d2e5baf
SHA1338a3ea8f1e929d8916ece9b6e91e697eb562550
SHA256172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb
SHA512d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB