General
-
Target
3dbd389b7c8810194e648107932b247b_JaffaCakes118
-
Size
1.1MB
-
Sample
240712-rp7b1axdjr
-
MD5
3dbd389b7c8810194e648107932b247b
-
SHA1
6067d142d94eecf84b70507179ef51bd4b2e53cb
-
SHA256
7ad4caa63ae70d62032c166e184120732456c15232fce48309a16ba8ebac9d74
-
SHA512
653dad8a484f9371bf6ea0a6aeb253962b1d04e398a5a51c5e2d855524d3e2810f79d586c86cfc39f6f08a2fc1111e8ca70ed5668274af4755dd77bed7096a78
-
SSDEEP
24576:3PS4zXuJH6m0hl9lUtWr4DQnHJEBLl+TSExYslKfFw7:K4zoanetWrzHJuLlKSe7
Static task
static1
Behavioral task
behavioral1
Sample
3dbd389b7c8810194e648107932b247b_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3dbd389b7c8810194e648107932b247b_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
3dbd389b7c8810194e648107932b247b_JaffaCakes118
-
Size
1.1MB
-
MD5
3dbd389b7c8810194e648107932b247b
-
SHA1
6067d142d94eecf84b70507179ef51bd4b2e53cb
-
SHA256
7ad4caa63ae70d62032c166e184120732456c15232fce48309a16ba8ebac9d74
-
SHA512
653dad8a484f9371bf6ea0a6aeb253962b1d04e398a5a51c5e2d855524d3e2810f79d586c86cfc39f6f08a2fc1111e8ca70ed5668274af4755dd77bed7096a78
-
SSDEEP
24576:3PS4zXuJH6m0hl9lUtWr4DQnHJEBLl+TSExYslKfFw7:K4zoanetWrzHJuLlKSe7
Score10/10-
Ardamax main executable
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-