Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 18:27
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe
-
Size
1.8MB
-
MD5
6cddc9af919c75723b4b01e659cdcf94
-
SHA1
c1824a630a0e8dc0b8e2372469ddd2459e5e2f4a
-
SHA256
e4e53aa188b08f901e5356b7eaf037ce202675e49e54640da9081f3eefc6df3a
-
SHA512
9310030991ccb020190744bdf66886554c510718da94b62250529bf85c58a652c37e7dee43aa4537b0c9b2915927f062b588483da807f7057d1a067755cef92f
-
SSDEEP
49152:DKOoYGMIckt0KdEVi2LWSdI3L8F4DJE9d6b7ENb2XhU:DKOoYvkt0Xi2LWSd8e4DJ/Yb2XO
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023c90-12.dat family_ardamax -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe Key value queried \REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000\Control Panel\International\Geo\Nation NSKR.exe -
Executes dropped EXE 1 IoCs
pid Process 3376 NSKR.exe -
Loads dropped DLL 5 IoCs
pid Process 4576 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 3376 NSKR.exe 3376 NSKR.exe 3376 NSKR.exe 1256 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NSKR Agent = "C:\\Windows\\SysWOW64\\28463\\NSKR.exe" NSKR.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\NSKR.001 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File created C:\Windows\SysWOW64\28463\NSKR.006 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File created C:\Windows\SysWOW64\28463\NSKR.007 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File created C:\Windows\SysWOW64\28463\NSKR.exe JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File created C:\Windows\SysWOW64\28463\AKV.exe JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe File opened for modification C:\Windows\SysWOW64\28463 NSKR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1256 3376 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1412605595-2147700071-3468511006-1000_Classes\Local Settings JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3108 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3108 vlc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 3376 NSKR.exe Token: SeIncBasePriorityPrivilege 3376 NSKR.exe Token: SeIncBasePriorityPrivilege 3376 NSKR.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe 3108 vlc.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3376 NSKR.exe 3376 NSKR.exe 3376 NSKR.exe 3376 NSKR.exe 3376 NSKR.exe 3108 vlc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4576 wrote to memory of 3376 4576 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 86 PID 4576 wrote to memory of 3376 4576 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 86 PID 4576 wrote to memory of 3376 4576 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 86 PID 4576 wrote to memory of 3108 4576 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 87 PID 4576 wrote to memory of 3108 4576 JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe 87 PID 3376 wrote to memory of 32 3376 NSKR.exe 96 PID 3376 wrote to memory of 32 3376 NSKR.exe 96 PID 3376 wrote to memory of 32 3376 NSKR.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6cddc9af919c75723b4b01e659cdcf94.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\28463\NSKR.exe"C:\Windows\system32\28463\NSKR.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 10683⤵
- Loads dropped DLL
- Program crash
PID:1256
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\NSKR.exe > nul3⤵
- System Location Discovery: System Language Discovery
PID:32
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\open_hehehask_36899.rec"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3376 -ip 33761⤵PID:4684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
1.4MB
MD5df1a83c25da2d5d749a61c6262912da3
SHA16448f99d05c1e86b860635e657e2521e69357ac2
SHA2564425390d2ad03c945ca399ca9a055326c78e44de38c82cb684a5d3fb5273bab8
SHA512894c790229ec2e85373c5cfaab5973998c93063f1ba215c38ff94b28e2cca0dd2a436927ed351af4cf759916ff25a5fbc5b613dd96af77cbf699b80c5edf12c4
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
462B
MD5b610d5eca070b0c40306a702975662c6
SHA1f1d257fb2a84e32bfc8bb182ac853d4c659e954d
SHA256a2ee517d4ec94d09bb786aadd8ed6d8d33b393aae5ea5fc44430b2a6e99cab2a
SHA512a404ae308c9d1fc88ba003b3e2007cdee223a49f9abb6a0f649f8afadcf301e2e5e324d3bd5372207d169d1e01bb36e1d24c9a7ca65bea70f3561dab8b9f0528
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8