Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03/02/2025, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe
-
Size
1.2MB
-
MD5
8adfc49f0696bc02019d11179389406e
-
SHA1
38482d684d9dce8abe4ba7a50af8e492f652e528
-
SHA256
d9e270de672638d5f1fe2d22441129e23b0c034f6f874cce788ebf72216312f5
-
SHA512
460a70c115278655435991a5a9865b6712bacd3ed3ed20e8559e9ac54d7022231dc0efba01b6c511c6b8a6343360e004e620676ea2db5ea74c780752988f57ab
-
SSDEEP
24576:gDshGCdMqm3fDqnWXHNrSa0bXJdyjSkH5FuDoRJs1L9GGJ:gZtfDxl0TKekODym1hBJ
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x000600000001948c-18.dat family_ardamax -
Executes dropped EXE 2 IoCs
pid Process 1452 archivoMZE 2864 CMNS.exe -
Loads dropped DLL 5 IoCs
pid Process 1452 archivoMZE 1452 archivoMZE 1452 archivoMZE 2864 CMNS.exe 2864 CMNS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CMNS Agent = "C:\\Windows\\SysWOW64\\28463\\CMNS.exe" CMNS.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\28463 CMNS.exe File created C:\Windows\SysWOW64\28463\CMNS.001 archivoMZE File created C:\Windows\SysWOW64\28463\CMNS.006 archivoMZE File created C:\Windows\SysWOW64\28463\CMNS.007 archivoMZE File created C:\Windows\SysWOW64\28463\CMNS.exe archivoMZE File created C:\Windows\SysWOW64\28463\AKV.exe archivoMZE -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\archivoMZE JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language archivoMZE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2864 CMNS.exe Token: SeIncBasePriorityPrivilege 2864 CMNS.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2856 JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe 2864 CMNS.exe 2864 CMNS.exe 2864 CMNS.exe 2864 CMNS.exe 2864 CMNS.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1452 2856 JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe 30 PID 2856 wrote to memory of 1452 2856 JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe 30 PID 2856 wrote to memory of 1452 2856 JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe 30 PID 2856 wrote to memory of 1452 2856 JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe 30 PID 1452 wrote to memory of 2864 1452 archivoMZE 31 PID 1452 wrote to memory of 2864 1452 archivoMZE 31 PID 1452 wrote to memory of 2864 1452 archivoMZE 31 PID 1452 wrote to memory of 2864 1452 archivoMZE 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8adfc49f0696bc02019d11179389406e.exe"1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\WINDOWS\archivoMZEC:\WINDOWS\archivoMZE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\28463\CMNS.exe"C:\Windows\system32\28463\CMNS.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2864
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
524B
MD5b925ae09eeeb101b40ab334864fc589e
SHA110aac3d5050856c47d28322773b6767e5d71e949
SHA256aabca045eb0925bef6be5dacc351d5866d5b959e95baa21dc094cedc7ff9450d
SHA512283f279549bdf158b7e0e5034e6e248dea02e4163771d0b151e9aecc54a4f552d4386ca239672083f586a33ca55dc3932fe84f12d12b5e903b9cf194d08d7566
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
480KB
MD5dec5fb7892185ebdb46b0d36ff32c579
SHA113def448fde635e1887bdae48df9ccfaa3a8a84b
SHA25617a01ee7f79b29cbdc51d1e2aff2a87dcf7c6b89bb6db30d6151850fbece7e10
SHA512f13682eab6e10ae01e79f592cdeca4f95cdd28b6ddfb0b2c4cd5c2beba9ee7ea9e09cf9818cd741cddc6a8d04d6d5a4c734c63c6c7d68ba4e667480e94ced81a
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8