Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/04/2024, 20:32
General
-
Target
e859b4da71ccbb5af5c81fa091000202_JaffaCakes118.exe
-
Size
4.2MB
-
MD5
e859b4da71ccbb5af5c81fa091000202
-
SHA1
d936d594e7e7be60a26a4b866205acc6803087cd
-
SHA256
cab3f6bf024d71f395f50f5aca9c7734bcf7dc36aae499f9480ff756753d4922
-
SHA512
9c2bf421013217dd640d7944f7df52da9554d87e2dd9867693887b0d0a87eeaef9aa91d5e03a7e8576baae6efbdf6fb8204364c8524a959effd3d72beef33ff3
-
SSDEEP
98304:m00xtzJZe2OIhGfJ195oh4pkJ8H0kZgsWizx:iRZk19IwkJ8Uke4t
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e859b4da71ccbb5af5c81fa091000202_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e859b4da71ccbb5af5c81fa091000202_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\MKTC.exe"C:\Windows\system32\28463\MKTC.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Rebel a.k.a Unikkatil - Shota ( Remix ).mp3"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x454 0x4e81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
3.8MB
MD5f3a31c28e66976707290777408b85aa6
SHA1efc7ceee6ebd4d15d76e8c69799a9f8bd5cddc88
SHA2562ff3299021b18f8168e957ba45e144e97703046ad30a7d066f099e051d06d8f8
SHA5129da393b04e696496153a899112dc6f8a347235efee32d61f99fa1ee7a47c4ed33cc537b8f77a041bb6f85266ba459cc9e102b4a5d25fa4fd4d1a59b032d99026
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
388B
MD5952ae4d484462c25859d80d14bb1e8bb
SHA1bdebf1e33fcd3b0e0429753c000f5af8b5ecac83
SHA2568cd1d60deb1feeef1a02aeee4c6468f0b814e11efce3fc5c2295922a0dac39e0
SHA5120c16fedd740b7ab25fbfcb19d8e0691cc8379f56fdac8a2cf0d7fe94e35d17682a9764f475dc0520e2610a7a7363779cabe91a89bb30b2d3246e41459a4bce94
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8
-
Filesize
4KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
2.7MB
-
Filesize
96KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
16.7MB
-
Filesize
2.0MB
-
Filesize
252KB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
992KB
-
Filesize
192KB
-
Filesize
96KB
-
Filesize
412KB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
68KB
-
Filesize
444KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
140KB
-
Filesize
72KB
-
Filesize
76KB
-
Filesize
132KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
344KB
-
Filesize
176KB
-
Filesize
1.2MB
-
Filesize
1.7MB
-
Filesize
368KB
-
Filesize
2.7MB
-
Filesize
16.7MB