Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/04/2024, 13:48
General
-
Target
fa6f155a35ddeb69a5308fccca7642f9_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
fa6f155a35ddeb69a5308fccca7642f9
-
SHA1
b707e0ffbd725f5b2ef5c94056d9fa1ff35f4d86
-
SHA256
4a4d9dadc73f3ed774fedc03c39d9f4a77d1c170de1b54009a75c229582d8c30
-
SHA512
7d0706b484cc9e1e4d6c66e2c8cc23565ccd864d44c25ccc5e8c04d4cf0e3d6dda15f8479367d0424b3650a4959c88fc4bd268c050f8a28305854f112f5f1d7b
-
SSDEEP
24576:xU4oTzPfqnYXWu0I4eOXhPf06mxOgn1/8sDo8xQU5BZOkx5smu5bTyAYT2BRHvPP:xULTzinYXWuOeaNgnhxDdx9TZOmxuJTd
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa6f155a35ddeb69a5308fccca7642f9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa6f155a35ddeb69a5308fccca7642f9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WEJUOU\BSD.exe"C:\Windows\system32\WEJUOU\BSD.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
297KB
MD5f269d5b7dad53bb49708b09285d6ab44
SHA1977f4205d630baf2fcded7b43d533accfb22affc
SHA256fa99c4878d82aa6ac4f4319cb944755cad087e9a0043b5a425499f5143c59a03
SHA51228b39e0ceef991144dd3b99186a525c60f4ed0b50229d5fc368869cf7782ffa6989ad429daa86d3254cd6e5fad5549ede5239de0346d4331da5cd4257e084f13
-
Filesize
456KB
MD548cfaed4d566c34716326302b49bdad2
SHA1566e0989b6bc7ed205f9ae250ea98e3a4d7fba52
SHA25654c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea
SHA51296c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0
-
Filesize
60KB
MD5a15c556f17d7db8287e023138942d5db
SHA1880bf8ec944120830dc2e2e040e5996e4e0e6c83
SHA256f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e
SHA512930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd
-
Filesize
43KB
MD5daabecdfba287a3333b60ae82211acd7
SHA1e67b4c7bf0dd71ad47263a58bb60be4bce504b84
SHA25612981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173
SHA512937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f
-
Filesize
1KB
MD529a7cf67958ab0ec7238689ef37cab65
SHA1c5d1f6d4f7b3a2c1e19b9348c1dbd6933a1b3222
SHA256da4645c593020c7be02a9a4951b53c960e9bc6c9c250247372cf8ed47b3210c9
SHA512890f1914c5e98ae266ed40931e0b70a97c03f5fa8750ddeaa9aa4a6ed10bed5ac52b870afe91c14fd22ad8f2badd3b974eb9c2a6ddddcbf1ad4b2535aa96eba2
-
Filesize
1.7MB
MD5f3819a6cab8ae058254c4abb3844d87e
SHA10f8b1a74af87f1823ec0d76e21a8d54d55a53a8b
SHA2563d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9
SHA512dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
