Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    31/01/2025, 20:57

General

  • Target

    JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe

  • Size

    502KB

  • MD5

    6dec3d08b6cb7ee70e3bb297f547908f

  • SHA1

    c0ba5a0828dae65e0be78be05d3de95aaa020567

  • SHA256

    13702a971a07d4c161ebbd5e1caa026ba54cff8365d24800c4c44a4d14c26cfe

  • SHA512

    0b4367421213e901335547f343a9b3f2484c3b3b4abd8e757f8f8e57e13afd314c4cf3a11be364cf348bda7f4d11fa76e21904695eb478104ae9ee0eb372cc45

  • SSDEEP

    12288:fG2JXAF7XA0/6gYK/uYu8HcEPayhKsdLkKxGs9:VJXUU4P/uYJLPlgsdLZxGE

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dec3d08b6cb7ee70e3bb297f547908f.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SysWOW64\28463\BIJA.exe
      "C:\Windows\system32\28463\BIJA.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\BIJA.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    405KB

    MD5

    dc82dc0d160dbcb878f36801464f7caa

    SHA1

    ab2f476da88d018b7aa27f8bdd9f15405b49169a

    SHA256

    a79c4e0c6490d7319ab85d4d4a2bbf9e0c84a8e5af86b52c9ddb8779ffabb8fd

    SHA512

    e3a8c85871026fdb15261da096aaac73236ceb5e6b60f091fa027565dc6f39ed4b9c27bb4b09d48aed6c5d849464e2e8540e1823e07d9bfbd77422d83125beed

  • C:\Windows\SysWOW64\28463\BIJA.001

    Filesize

    418B

    MD5

    17b61b9d2f53967a3de1d69a29cb61f6

    SHA1

    8bac9901e16a93b45d476103e5d01b35e05e07c1

    SHA256

    f50f07614d31c6516130546b2983c978255edebe6efccdae9c094592e93c7e03

    SHA512

    09e83dae9e54f3e2b7220d280ce0dc1e7a3a77255a4079623ab86da90806507496a14f46e47f4487caaf1adfbf3439af1393499484622342906d8c4977626696

  • C:\Windows\SysWOW64\28463\BIJA.006

    Filesize

    8KB

    MD5

    d06046faed6ce5b6c70786ca53cd79a6

    SHA1

    18a945748b4aa894487530612e6aaf20c4a5d074

    SHA256

    fc01b2bcc8f17f707502d7fd5a14217863a1e3e00a8529c2a9e8d46f39ee1412

    SHA512

    96769913e2a30ccc21deaa7803013d44ae437edee2bf9fc0532055da3c4a6c5de0bb6485da46dca00caab35a43014361713d5282e0783065f9ce5a7523012e90

  • C:\Windows\SysWOW64\28463\BIJA.007

    Filesize

    5KB

    MD5

    2166b0dbd65cc3244d0a2e7695b32a40

    SHA1

    358e6bbd414ce534c6bf60785281928ca8abcc23

    SHA256

    6c97872edcb4f6af14d0650f6b9f7256d0081b1d7ff77050e56fbe1d894044d2

    SHA512

    45e51c7cd899eaa7187d7adee6bf89cf52b4c48908e72499afdfeaf5db5846614a9bfe60773abd551a8e89f718ad5d875cdff3f25f5a80ca219d49418157d6eb

  • \Users\Admin\AppData\Local\Temp\@AEF5.tmp

    Filesize

    4KB

    MD5

    d9cb831b02f14f8371acd33c684190fb

    SHA1

    5035c9ceaf35bf0c14cdc0349d1284beb0e3892b

    SHA256

    be821327fbd0d0a4b0e61f939349cfaa660a3cbcf037dd8c664a1a52372b32a5

    SHA512

    452d409cfd53dc8a98e7e9746d7c88e0545df024f1fe5ab81a1ecab84664b8ca7eb8d53d1c66322d49dfe74035d5e6540ad7c95b57757fe91af99bb8edab097e

  • \Windows\SysWOW64\28463\BIJA.exe

    Filesize

    500KB

    MD5

    a4c7f5f230b30d5e289a092bd915952c

    SHA1

    db42fb8d2fdf74ddbe6789a4e4a725b41e8612cf

    SHA256

    531a5334e3132b0df427514b614075800d0cf0f4ada9da4c8a60632b53f3fd5d

    SHA512

    601475753cf9159670c544d53fbbe31fc7063cb95c905c3e1d5a9bc296482e29ff0abc3e5058f724d622c4aeaf3a35ebff75752828bd7176aae291a51713d56e

  • memory/2132-24-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2132-27-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB