Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2025, 00:05

General

  • Target

    guia del AMORRRRRRRR.exe

  • Size

    4.3MB

  • MD5

    d876fdc6818190fc7ecc1e849cb6b3c0

  • SHA1

    ca964ab6263ef213b0e865dd4a30b31776e78744

  • SHA256

    e423ed04c23696b1463447e89aa2b8084aea4746dd5e039f4a8218f59675f7c6

  • SHA512

    80cba59de560e1168e31a0e053b99c53aee9afd841284bf0717426df773f7ff59de3b0454da74e528f3751c798ba5f01c5e91875c133f41261fb1c47e6ca29dc

  • SSDEEP

    98304:F1dl23qOyYd6oHKzh9CNs8142z6VVegllWP2QN/rK5OfpFE:myYYoqUH1/zCvG2QtW8+

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 31 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\guia del AMORRRRRRRR.exe
    "C:\Users\Admin\AppData\Local\Temp\guia del AMORRRRRRRR.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Users\Admin\AppData\Local\Temp\Install.exe
      "C:\Users\Admin\AppData\Local\Temp\Install.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\SysWOW64\28463\HBMK.exe
        "C:\Windows\system32\28463\HBMK.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3116
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\3-cuando.mp3"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5096
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x3d8 0x500
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3-cuando.mp3

    Filesize

    3.2MB

    MD5

    966999a7762c93404988e186372196b2

    SHA1

    4be609785a55bd53ffe4773f4f203869f394ec25

    SHA256

    c11cd70f089d7fe02808f7729434100d84b77091d6df39a6d21ecceab17d9143

    SHA512

    820807f07d9f7e0067c4c1b595f9e951faf93120fd2e2f9ec6c2855bfa3b8c2b6f0c588019b8de717c16dcd729b8bac6babcc4d85ffe25b6896131b16403cf4a

  • C:\Users\Admin\AppData\Local\Temp\@9B07.tmp

    Filesize

    4KB

    MD5

    4b8ed89120fe8ddc31ddba07bc15372b

    SHA1

    181e7ac3d444656f50c1cd02a6832708253428e6

    SHA256

    2ae6b0e14465338be0bc5ad10703f5c823d092ebb8cff7e5a05b7d79c8459b93

    SHA512

    49269b71270b3eda0ddcb399021de9c88f6fd2086cf54fa4898a91e64afe109d44b635d47a5ea9bae7f53a5e968af97fa13bdf699ba00ce879ecadd7bbc8af23

  • C:\Users\Admin\AppData\Local\Temp\Install.exe

    Filesize

    787KB

    MD5

    d06ded340770bb22e613ef7e7dfc3de0

    SHA1

    1c2be300320e9cecbba81b94e96bdbb12012c101

    SHA256

    f0cc11b7493de36b4ef0aa3a90aa2acdc71521577bcadaa931673365e2ecd0d9

    SHA512

    c8841d2f1be82ed064e3334dcc8912b98b26f0cd9d07f70a52a7dc119353b9aba5fa12acd508ae43f30282ca3d170736c9c15751af9f76a9bb2ca16c33429e77

  • C:\Users\Admin\AppData\Local\Temp\sfx.ini

    Filesize

    198B

    MD5

    0f1cae3280963a60c4625e18fc1b7c22

    SHA1

    3d2b70780fa54274229d78c970bb0c6a632a1337

    SHA256

    905f02023807d7e9e335a800b7be29ee89699438ab6071e034e398739927593e

    SHA512

    5e015d4165d6cc2a3232640cf2c54f82a6c9bd583db3569ab7e9c096e8b7c4fab7bfd54725232b62d86d9687d2fc17ba6946ce72fa8ca86b94e060215168e13a

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    46ccfd974518e5849738449034a05a17

    SHA1

    d391108816aed7ba8f7beb205ad7171c74eae6b2

    SHA256

    571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe

    SHA512

    773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a

  • C:\Windows\SysWOW64\28463\HBMK.001

    Filesize

    624B

    MD5

    7bfd3b9de4a6b14eccef8fa67b32c021

    SHA1

    75636b19b8e6ee04e08282232c06c18ffbf07be3

    SHA256

    7461e839232322955ad4c4cfa045868356adccf1f93206c154abc07ebfe42316

    SHA512

    13b66816a442a6dd5fbd352e1f95aedc2b15e50e1db18594581eb9ef57d46091176b60bef34274aebd36e00620f9677ba595f7a9e00e638ca27d515d7d569693

  • C:\Windows\SysWOW64\28463\HBMK.006

    Filesize

    8KB

    MD5

    395bbef326fa5ad1216b23f5debf167b

    SHA1

    aa4a7334b5a693b3f0d6f47b568e0d13a593d782

    SHA256

    7c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1

    SHA512

    dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679

  • C:\Windows\SysWOW64\28463\HBMK.007

    Filesize

    5KB

    MD5

    1b5e72f0ebd49cf146f9ae68d792ffe5

    SHA1

    1e90a69c12b9a849fbbac0670296b07331c1cf87

    SHA256

    8f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e

    SHA512

    6364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc

  • C:\Windows\SysWOW64\28463\HBMK.exe

    Filesize

    649KB

    MD5

    2bff0c75a04401dada0adfab933e46a7

    SHA1

    364d97f90b137f8e359d998164fb15d474be7bbb

    SHA256

    2aa53bc5da3294817f95d8806effdf28e5af49661a955256c46db2b67cb6e6da

    SHA512

    88b82973d3c042bceb75e12297111fa7b8bd4e2a7a37d26b698c595d8d75ec670cc7aebfa2572206c1b2a4ecbbfa3103affb8bee6d7ef47428a225e2cd1bea3f

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    105B

    MD5

    27c90d4d9b049f4cd00f32ed1d2e5baf

    SHA1

    338a3ea8f1e929d8916ece9b6e91e697eb562550

    SHA256

    172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb

    SHA512

    d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae

  • memory/3116-77-0x00000000005B0000-0x00000000005B1000-memory.dmp

    Filesize

    4KB

  • memory/3116-88-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3116-56-0x0000000003350000-0x0000000003351000-memory.dmp

    Filesize

    4KB

  • memory/3116-67-0x0000000003390000-0x0000000003391000-memory.dmp

    Filesize

    4KB

  • memory/3116-66-0x0000000003390000-0x0000000003391000-memory.dmp

    Filesize

    4KB

  • memory/3116-65-0x0000000003390000-0x0000000003391000-memory.dmp

    Filesize

    4KB

  • memory/3116-64-0x0000000003340000-0x0000000003343000-memory.dmp

    Filesize

    12KB

  • memory/3116-57-0x0000000003350000-0x0000000003351000-memory.dmp

    Filesize

    4KB

  • memory/3116-54-0x0000000003350000-0x0000000003351000-memory.dmp

    Filesize

    4KB

  • memory/3116-53-0x0000000003350000-0x0000000003351000-memory.dmp

    Filesize

    4KB

  • memory/3116-52-0x00000000024C0000-0x00000000024C1000-memory.dmp

    Filesize

    4KB

  • memory/3116-51-0x0000000002510000-0x0000000002511000-memory.dmp

    Filesize

    4KB

  • memory/3116-50-0x0000000002550000-0x0000000002551000-memory.dmp

    Filesize

    4KB

  • memory/3116-49-0x0000000002530000-0x0000000002531000-memory.dmp

    Filesize

    4KB

  • memory/3116-48-0x0000000002540000-0x0000000002541000-memory.dmp

    Filesize

    4KB

  • memory/3116-47-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/3116-80-0x00000000033A0000-0x00000000033A1000-memory.dmp

    Filesize

    4KB

  • memory/3116-79-0x0000000000C30000-0x0000000000C31000-memory.dmp

    Filesize

    4KB

  • memory/3116-78-0x0000000003360000-0x0000000003361000-memory.dmp

    Filesize

    4KB

  • memory/3116-58-0x0000000003350000-0x0000000003351000-memory.dmp

    Filesize

    4KB

  • memory/3116-76-0x0000000003350000-0x0000000003351000-memory.dmp

    Filesize

    4KB

  • memory/3116-59-0x0000000003350000-0x0000000003351000-memory.dmp

    Filesize

    4KB

  • memory/3116-60-0x0000000003340000-0x0000000003341000-memory.dmp

    Filesize

    4KB

  • memory/3116-46-0x00000000022E0000-0x000000000233A000-memory.dmp

    Filesize

    360KB

  • memory/3116-45-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3116-55-0x0000000003350000-0x0000000003351000-memory.dmp

    Filesize

    4KB

  • memory/3116-89-0x00000000022E0000-0x000000000233A000-memory.dmp

    Filesize

    360KB

  • memory/3116-90-0x0000000003340000-0x0000000003341000-memory.dmp

    Filesize

    4KB

  • memory/3116-91-0x0000000003390000-0x0000000003391000-memory.dmp

    Filesize

    4KB

  • memory/3116-92-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/3116-152-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/5096-97-0x00007FFDAB530000-0x00007FFDAB547000-memory.dmp

    Filesize

    92KB

  • memory/5096-111-0x00007FFD94480000-0x00007FFD94491000-memory.dmp

    Filesize

    68KB

  • memory/5096-95-0x00007FFDA5440000-0x00007FFDA56F6000-memory.dmp

    Filesize

    2.7MB

  • memory/5096-96-0x00007FFDADE80000-0x00007FFDADE98000-memory.dmp

    Filesize

    96KB

  • memory/5096-103-0x00007FFD96F20000-0x00007FFD9712B000-memory.dmp

    Filesize

    2.0MB

  • memory/5096-100-0x00007FFDAA460000-0x00007FFDAA471000-memory.dmp

    Filesize

    68KB

  • memory/5096-99-0x00007FFDAA480000-0x00007FFDAA497000-memory.dmp

    Filesize

    92KB

  • memory/5096-98-0x00007FFDAB450000-0x00007FFDAB461000-memory.dmp

    Filesize

    68KB

  • memory/5096-102-0x00007FFDAA420000-0x00007FFDAA431000-memory.dmp

    Filesize

    68KB

  • memory/5096-94-0x00007FFDAAB30000-0x00007FFDAAB64000-memory.dmp

    Filesize

    208KB

  • memory/5096-101-0x00007FFDAA440000-0x00007FFDAA45D000-memory.dmp

    Filesize

    116KB

  • memory/5096-110-0x00007FFDA5DE0000-0x00007FFDA5DF1000-memory.dmp

    Filesize

    68KB

  • memory/5096-109-0x00007FFDA5EF0000-0x00007FFDA5F01000-memory.dmp

    Filesize

    68KB

  • memory/5096-108-0x00007FFDA5F10000-0x00007FFDA5F21000-memory.dmp

    Filesize

    68KB

  • memory/5096-104-0x00007FFD95E70000-0x00007FFD96F20000-memory.dmp

    Filesize

    16.7MB

  • memory/5096-107-0x00007FFDA66D0000-0x00007FFDA66E8000-memory.dmp

    Filesize

    96KB

  • memory/5096-106-0x00007FFDAA3F0000-0x00007FFDAA411000-memory.dmp

    Filesize

    132KB

  • memory/5096-105-0x00007FFDA5E00000-0x00007FFDA5E41000-memory.dmp

    Filesize

    260KB

  • memory/5096-93-0x00007FF766320000-0x00007FF766418000-memory.dmp

    Filesize

    992KB