Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2025, 10:48

General

  • Target

    JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe

  • Size

    2.7MB

  • MD5

    34d5c1f08f758fea569cc2ca9673191f

  • SHA1

    dde401e304c5a34b0ec0890753fda71721dd8d32

  • SHA256

    aabb0cd30e28d1c4efad9fbefd8deaa5d5ee390182a28e2c1f08fcfa011f059b

  • SHA512

    1bd6c7a7a72a1b3831bed7d982e7d9e4d2ac13d35b89bfc3caa058943e4c91a342317b8a33a1b06857b7d18b8e7dedb4c75a5fcb42805c362756473426295670

  • SSDEEP

    49152:RBCyAhuO1T5UmAgL6l9r3paHreU3eBAIwMxdm+JZIBtE982xu:+yAhuO1T5UmAgL6l9r3paHreSeBAIwM+

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 16 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_34d5c1f08f758fea569cc2ca9673191f.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Users\Admin\AppData\Local\Temp\EliteSwitch.exe
      "C:\Users\Admin\AppData\Local\Temp\EliteSwitch.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2472
    • C:\Users\Admin\AppData\Local\Temp\Install.exe
      "C:\Users\Admin\AppData\Local\Temp\Install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\SysWOW64\28463\LQJQ.exe
        "C:\Windows\system32\28463\LQJQ.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\LQJQ.001

    Filesize

    428B

    MD5

    8b06e2e6f38da57ba9afec9cf9726265

    SHA1

    bfd8b3c1214421d4de8e05854fa9fb46de3583b6

    SHA256

    b9cc408585474c072f4559f0af93a8af6f75d0d8851cce4d1c7fd69f64a719d0

    SHA512

    0c3af6a64424fd5cfaa0cf298eb8513c9477c23d23e1ef85d7b378fc63fc86f73624fdfba2036d8c10971d27f8f5d02d78620b97455f60890074c64db2491f0a

  • C:\Windows\SysWOW64\28463\LQJQ.006

    Filesize

    8KB

    MD5

    75f215af21ded98ab7a1a2a0ea1f1a30

    SHA1

    e85649693a178064da1aa4cc7c8e34c92472ba0d

    SHA256

    af46dca2a4f77f0c977fec74312a41e20bd064bd2ca17bec0f09afd67d7e1e3d

    SHA512

    1582847dae80134e5272fc1b125d6af13746263601ebc8b540ea5fd3e4fc0a05f6e783c59a6052b971efd15d26d9d55b86345292160e9c79041b7c57f9a74f54

  • C:\Windows\SysWOW64\28463\LQJQ.007

    Filesize

    5KB

    MD5

    528f383007234b421e3f1072fae5af11

    SHA1

    b19c49e17263d940ffa4d46c60a7cf2d03525f09

    SHA256

    531958a2b1de11d2da2eb8a5409f57c1f31253f79f790473d0efc0ae5567b61f

    SHA512

    d1813fc77b21ebcdada0cc9c410e533a39a436a038d91cb131bf03c987dab6e7e5b4c99f1a135adde84b4afcbd0a9f0f13931bae3c45c5782d7557fa620b4830

  • \Users\Admin\AppData\Local\Temp\@D604.tmp

    Filesize

    4KB

    MD5

    fc0fea286539e5d84ccf49020ca3823b

    SHA1

    d43711c776edf9a07abed6bb95ed4a0e45e14d52

    SHA256

    2520256a587481813a5557e54a65f2fca97baee5df333102adfff2dbdabb4828

    SHA512

    70e1a5ec247d5e3057fe19f7f34b31ee7a79ab16dca73794829d9d81e3ed891881df424f7aa44b9424550574ab61c95d376163b16080aa7cfd61e986e6988ea2

  • \Users\Admin\AppData\Local\Temp\EliteSwitch.exe

    Filesize

    2.4MB

    MD5

    d97e40003a44f536f104d39e791b1f91

    SHA1

    d9be56241887aacc812ac5038c49be9a412308d6

    SHA256

    203c038ad2d7b94b70bf5b33732dbc55b2f508f5439882884ae90106a7c3f097

    SHA512

    250abc156be8ab52d1dfecf192d7299b558b14c16ebbdb7900dff4111c3e03deac303081ea048da9f9aa8f794197c72d1c0376595aeb9c11db6b82506c9593a7

  • \Users\Admin\AppData\Local\Temp\Install.exe

    Filesize

    283KB

    MD5

    5fcd58603b6befc359ccf58ce1e1d276

    SHA1

    f5eec52141daa9d347fe67de694522acc4f20279

    SHA256

    42f0c9d211b10125143ecfcc9b4448d0c0d5a2966e8c2dd2bee71c027ca81124

    SHA512

    05b8e38f7c7827eb3eb272df29dae4f554a40077c207558c158823a463e8ec03de934fdb3e3d0bb563454b5a52f8be9cd1889ae2280605b35f218677570ee100

  • \Windows\SysWOW64\28463\LQJQ.exe

    Filesize

    513KB

    MD5

    1800b0b263035d94f7bb5e9e70270032

    SHA1

    c8ba77fa2e414ad11e39a6493e15c078c99d80e6

    SHA256

    0b15e820894e38d036e75abd442e1cebbfb734c4a50fd0f3adcd3b77211caa5e

    SHA512

    1431bedcba045f110354c7ec8a34ad5677447aa647581ebc86c25ee38397d2eff4b02d438227144b934ce65b26a2be65c44b761bd4b46518ff44ba6aaf06f29f

  • memory/2328-17-0x0000000000400000-0x00000000006BB000-memory.dmp

    Filesize

    2.7MB