Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2025, 13:01

General

  • Target

    JaffaCakes118_71fbbc5924741e4d7edc1b689a5d9882.exe

  • Size

    608KB

  • MD5

    71fbbc5924741e4d7edc1b689a5d9882

  • SHA1

    44d520f8d1f0a3dcf9e6be7996131fc9e57d05a9

  • SHA256

    d44d06840e3fccfa5616f98f8dfd2b8de78242040fe7cc14db1cd78bc165f1e7

  • SHA512

    c068c9e247c8382df94560404671a6eef8f27f71efffa01557ea88dddea9487c40dbab2512bc6b055cc5fbe0307eb276e419518b09d515a501ece47ce89d120d

  • SSDEEP

    12288:1uEQlKRShvraBT31+I9K717p0tSN6iPSuCbnjrIC/YJw4TNWFXrNrtAr:1CScvrJBitSV4bIC/yfm9

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_71fbbc5924741e4d7edc1b689a5d9882.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_71fbbc5924741e4d7edc1b689a5d9882.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\Install.exe
      "C:\Users\Admin\AppData\Local\Temp\Install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Windows\SysWOW64\28463\SAUF.exe
        "C:\Windows\system32\28463\SAUF.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2736
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE >> NUL
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\SAUF.001

    Filesize

    428B

    MD5

    8efe2ac4145729cd42e0004e674658ae

    SHA1

    d3fb66e77cc7cbdc0fb75b214ca97b74c48268be

    SHA256

    6d60dc6f1b5c7f4e8d17eeadec85a91821977ae6e8813a2b5bd715f3e61d800a

    SHA512

    7bc6003a5c813f6f9def80e5b4ca58dbafafefc91b651e0d8838b4dd8f253e2c009ba6fb62d5f6035185bd052b01793d252a3f2cfa8b2304fc064b9af1905709

  • C:\Windows\SysWOW64\28463\SAUF.006

    Filesize

    8KB

    MD5

    5153b016d36928c296131c5c8e669446

    SHA1

    c444f61a2dc49ede6a2325f26d76af66de5989d2

    SHA256

    4c52ec0d5d4cad21ed134af76f64c3cb44b826594641f44487e4625f5bc96f59

    SHA512

    c9084ff30f1f023b1f9cd00dc66cdbf846e95993093163c3e71a13535ccfc79d59be5b28a78ccfa6b0a82389b08b157676d71a9ccca2c170369080feac386f09

  • C:\Windows\SysWOW64\28463\SAUF.007

    Filesize

    5KB

    MD5

    80bbc7ace13d97396bd7b1abbaf4008b

    SHA1

    d013c0def603915675b1e0ce5877d413cdaf6523

    SHA256

    18dbfb27d4b10501e8426db1a78df8247f6570656d183f78b061d7db4c7865ae

    SHA512

    bc7afd0e730f432852d374812827077574181928aa97c25d8170ce1b766677383360bf2bb21afc51e8168eb3f6539ce8499c4002d86190f27d4836da3f907919

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    105B

    MD5

    27c90d4d9b049f4cd00f32ed1d2e5baf

    SHA1

    338a3ea8f1e929d8916ece9b6e91e697eb562550

    SHA256

    172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb

    SHA512

    d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae

  • \Users\Admin\AppData\Local\Temp\@208B.tmp

    Filesize

    4KB

    MD5

    557e0039dc13a0453af7ca9373a0d301

    SHA1

    50efb19b1b1eddd10ddb4c2ff23d18cccba92dfe

    SHA256

    54850e4c8644c042b15dab73a15135105ff84a240d26d1476c8b80d176a341fc

    SHA512

    d96fdc89ddbcd8459966c9548d3243a0fa319f8be2f418b4e17f313fb3f86d32dd7f254a035641f35e35ed849832773c0d1fe34ff362761309c64e959c025a98

  • \Users\Admin\AppData\Local\Temp\Install.exe

    Filesize

    590KB

    MD5

    dc7a20e6fcd4a76e14d3245796a36b13

    SHA1

    be9435bb144e9a0c5291876f40ee54ea2d2ea195

    SHA256

    0ddf2d4b7e78a971a551b82f95072fbf05266842149d8c5306bb2f4ed2dba9e9

    SHA512

    f4cc2ab3ab95a67fa42a199bb30503d2e0af108d928bd49428892ea233e430e3a961fe930d7431885cd8015879b8db99fcf63f467bb3f0f2528bd15646941213

  • \Windows\SysWOW64\28463\SAUF.exe

    Filesize

    648KB

    MD5

    5530832fa82582288ce640f73a4915a0

    SHA1

    c40673ed59a61dd3b39f8ed6d0e1345838d98e44

    SHA256

    6f7daff3caf7f24a00e08e4ed414b4d23e13d2cac4657ad7a071d9cbeb42cb88

    SHA512

    ee2a2dc3c85a13b39f15a276f842afab8d341aacb457c1750b8bf0fa46b03a3bfabeff5be6439f3edf2c428d504ecabf07a399ebbdb09a75693309b55903775c

  • memory/2736-30-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2736-31-0x0000000000240000-0x000000000031F000-memory.dmp

    Filesize

    892KB

  • memory/2736-38-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2736-42-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2804-21-0x0000000002550000-0x000000000262F000-memory.dmp

    Filesize

    892KB