Analysis
-
max time kernel
94s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
15/07/2024, 04:34
General
-
Target
483d53071dd1845cbd610bd584ca4c05_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
483d53071dd1845cbd610bd584ca4c05
-
SHA1
17cb391eaf19a106a9894202aa2078e02fc1b679
-
SHA256
f523ecf98a3151c1f106b231398a0918a51665130dc5adb1e3d667cdfb430925
-
SHA512
c4f82f191ad810bc2aec18d7f82298a1078d725df98f006e76c44d7a00684d2eeadf64d730da52b9971f92e2978f343e7d67e80d9d1c8aae3208e30e90d2d81e
-
SSDEEP
24576:sUFYB1OlMr9k2vblkDTX+hkG4gtbTvFPfWD0x+CEQKC:st1O2iKblkvG4YfvFPA0oC/
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\483d53071dd1845cbd610bd584ca4c05_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\483d53071dd1845cbd610bd584ca4c05_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\TICF.exe"C:\Windows\system32\28463\TICF.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5a55cbc0f0125b005ef369020b4c17806
SHA1010af3e2e84b337e91f5e0c791b01e1d527211ce
SHA25627cfe74936e4090aafbef07ee45725923f4b1243135e1e3a51e3385dbcd7b637
SHA51288e5f7905c86d73bc5af028f20c8bf49f700307926c5b92814c245abe08e9c35841116d428ddbd7b957b47ccc8980684c12608b6818e4b6c1c8c0d27d54a07be
-
Filesize
819KB
MD57cc7448bd9e8bb0856428a9dc3ada857
SHA1f4729fe861c42ff1118f2c36e7322b67f470fdf3
SHA256472e4e03a78b3b9cf7192e7cda52cf439161b37c987d09f05dcd63a9e7ddcc7a
SHA512c32bb6fbc4bf6573d1c7b5aa2797c6715d12690003ebc4912a3acc5b7e20ba61297a67898a4730f4497ae739f214702f8bcf2586b5c998a997ac32bfb2b65820
-
Filesize
457KB
MD546ccfd974518e5849738449034a05a17
SHA1d391108816aed7ba8f7beb205ad7171c74eae6b2
SHA256571aae1f8a260909dbc45c67b4c547fc573c07097b36d4e18db0e36d91deccfe
SHA512773a40a37ebc54cbde7c40ca98001150e78da43726e475f1ee25ef869a39682c0fcd46fb57cf6130151cd8115aa6f2c196e57414affe464fd3b137eb5b317a7a
-
Filesize
416B
MD55c4e7e0a9c2b183940cc6ddc87b1fa6c
SHA1e7f9257d98c5eae9f2158b8e30b917693d6eceb8
SHA256453f4d368998e7d75574ff2b2a09bfb6236fa10225dbe3497e047d5897f21a60
SHA51259c2e7acd47097c4115aa2401690cc233fdb036c00b5cab75f680ea13dc74cd6a5f2193df798619ab88784f9df55ba1eb06fb23df3eef790a6cac5d9d3ea0c02
-
Filesize
8KB
MD5395bbef326fa5ad1216b23f5debf167b
SHA1aa4a7334b5a693b3f0d6f47b568e0d13a593d782
SHA2567c1c4ba8978d3ec53bc6da4d8f9e5e1ca52edf5ccf5ec19ef06b02055ff3b3d1
SHA512dc3f3d7501feb10623807e89f28a0e38bdbbd4a7e2ad964c8ab33c392bde61896fe40bb7773f6309cd59ad9a686decbd81c15b588ac8d311fd2a273ac9410679
-
Filesize
5KB
MD51b5e72f0ebd49cf146f9ae68d792ffe5
SHA11e90a69c12b9a849fbbac0670296b07331c1cf87
SHA2568f4485675fe35b14276f5c8af8a6b42f03cf1b5de638355e4c4b28397385e87e
SHA5126364f5581de5aaec09b5d1c4e5745193f981ff93cf91e20c6c9ff56566b5d182ccbdacf9aeed1d7a01460eb21619e14ac4ab31b083a951b45b3b7f9d93a62ffc
-
Filesize
912KB
MD56768ba61744862704760b66ce8f8fdd4
SHA1e86cbed8cf20c2a9c76219d0c434bc310ffb2392
SHA2564cf4bf2b7d2bb4215e255e1f2b1238ad989f3c8a98ebfd5cb033bccf32fedaa0
SHA512eadb56b633707724ef4f47f8b421b0f3b2afa5a9800fae030f81aefae483eed6b494da470278273f388c3ae346a33cbbfe742924d231dab1c9b42bbefaf95a61
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
308KB
-
Filesize
1.6MB
-
Filesize
308KB
-
Filesize
908KB
-
Filesize
4KB
-
Filesize
908KB