Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe
-
Size
1.8MB
-
MD5
6cddc9af919c75723b4b01e659cdcf94
-
SHA1
c1824a630a0e8dc0b8e2372469ddd2459e5e2f4a
-
SHA256
e4e53aa188b08f901e5356b7eaf037ce202675e49e54640da9081f3eefc6df3a
-
SHA512
9310030991ccb020190744bdf66886554c510718da94b62250529bf85c58a652c37e7dee43aa4537b0c9b2915927f062b588483da807f7057d1a067755cef92f
-
SSDEEP
49152:DKOoYGMIckt0KdEVi2LWSdI3L8F4DJE9d6b7ENb2XhU:DKOoYvkt0Xi2LWSd8e4DJ/Yb2XO
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0007000000017488-9.dat family_ardamax -
Executes dropped EXE 1 IoCs
pid Process 2348 NSKR.exe -
Loads dropped DLL 5 IoCs
pid Process 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 2348 NSKR.exe 2348 NSKR.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NSKR Agent = "C:\\Windows\\SysWOW64\\28463\\NSKR.exe" NSKR.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\NSKR.006 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File created C:\Windows\SysWOW64\28463\NSKR.007 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File created C:\Windows\SysWOW64\28463\NSKR.exe JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File created C:\Windows\SysWOW64\28463\AKV.exe JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File opened for modification C:\Windows\SysWOW64\28463 NSKR.exe File created C:\Windows\SysWOW64\28463\NSKR.001 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2536 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2536 vlc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 2348 NSKR.exe Token: SeIncBasePriorityPrivilege 2348 NSKR.exe Token: SeIncBasePriorityPrivilege 2348 NSKR.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe 2536 vlc.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2348 NSKR.exe 2348 NSKR.exe 2348 NSKR.exe 2348 NSKR.exe 2348 NSKR.exe 2536 vlc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2348 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 30 PID 2100 wrote to memory of 2348 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 30 PID 2100 wrote to memory of 2348 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 30 PID 2100 wrote to memory of 2348 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 30 PID 2100 wrote to memory of 2536 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 31 PID 2100 wrote to memory of 2536 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 31 PID 2100 wrote to memory of 2536 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 31 PID 2100 wrote to memory of 2536 2100 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 31 PID 2348 wrote to memory of 792 2348 NSKR.exe 33 PID 2348 wrote to memory of 792 2348 NSKR.exe 33 PID 2348 wrote to memory of 792 2348 NSKR.exe 33 PID 2348 wrote to memory of 792 2348 NSKR.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\28463\NSKR.exe"C:\Windows\system32\28463\NSKR.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\NSKR.exe > nul3⤵
- System Location Discovery: System Language Discovery
PID:792
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\open_hehehask_36899.rec"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5df1a83c25da2d5d749a61c6262912da3
SHA16448f99d05c1e86b860635e657e2521e69357ac2
SHA2564425390d2ad03c945ca399ca9a055326c78e44de38c82cb684a5d3fb5273bab8
SHA512894c790229ec2e85373c5cfaab5973998c93063f1ba215c38ff94b28e2cca0dd2a436927ed351af4cf759916ff25a5fbc5b613dd96af77cbf699b80c5edf12c4
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
462B
MD5b610d5eca070b0c40306a702975662c6
SHA1f1d257fb2a84e32bfc8bb182ac853d4c659e954d
SHA256a2ee517d4ec94d09bb786aadd8ed6d8d33b393aae5ea5fc44430b2a6e99cab2a
SHA512a404ae308c9d1fc88ba003b3e2007cdee223a49f9abb6a0f649f8afadcf301e2e5e324d3bd5372207d169d1e01bb36e1d24c9a7ca65bea70f3561dab8b9f0528
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8