Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 06:04
Static task
static1
Behavioral task
behavioral1
Sample
4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe
-
Size
503KB
-
MD5
4d1729e5a25bdc7bab43b6cdb6ae91ec
-
SHA1
1f4d90b4b78f0aa15f64281f8a28cbeddc3ce679
-
SHA256
6bdf99e0672a6231d54b3751b5802c717ab39dc24a102f0b30df66a0955ab260
-
SHA512
ecd6a842adbcf3db66548a0ff1cda4faf3359269169d08467b32a385246a06f7c818c8cf3c904ea224f523dccdacee0e2f2e6fdfe59be0fe6a36172c5d383210
-
SSDEEP
12288:ylQRUTV5n8PfCxr31owNStfhhAEjplc3Y49D631iplUNZTmy98uqAdK0mA:UTV5n8CxjS0ajAEtlcj9DiiploUyOuqm
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0007000000016d07-9.dat family_ardamax -
Executes dropped EXE 1 IoCs
pid Process 620 FPBE.exe -
Loads dropped DLL 5 IoCs
pid Process 2952 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe 2952 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe 2952 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe 620 FPBE.exe 620 FPBE.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FPBE Agent = "C:\\Windows\\SysWOW64\\28463\\FPBE.exe" FPBE.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\AKV.exe 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 FPBE.exe File created C:\Windows\SysWOW64\28463\FPBE.001 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\FPBE.006 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\FPBE.007 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\FPBE.exe 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 620 FPBE.exe Token: SeIncBasePriorityPrivilege 620 FPBE.exe Token: SeIncBasePriorityPrivilege 620 FPBE.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 620 FPBE.exe 620 FPBE.exe 620 FPBE.exe 620 FPBE.exe 620 FPBE.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2952 wrote to memory of 620 2952 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe 31 PID 2952 wrote to memory of 620 2952 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe 31 PID 2952 wrote to memory of 620 2952 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe 31 PID 2952 wrote to memory of 620 2952 4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe 31 PID 620 wrote to memory of 2584 620 FPBE.exe 32 PID 620 wrote to memory of 2584 620 FPBE.exe 32 PID 620 wrote to memory of 2584 620 FPBE.exe 32 PID 620 wrote to memory of 2584 620 FPBE.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\28463\FPBE.exe"C:\Windows\system32\28463\FPBE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\FPBE.exe > nul3⤵PID:2584
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD5adbec81b510dcfe49835f95940ef961d
SHA177940f6e46fbd5f53de23bd49afe9172470769d0
SHA256466efb4b00255f21075b340fc2d2444f182947ab90270840543658c5fd3a9b95
SHA512ef4324a06fbe960933f5551ea6ac587cd87cb6025bc6879a2b81a4d1033cfe87e244b6a87fb5db5ad065321ccbe8035cf24a668452d5b0c6a4063a355a12b2a7
-
Filesize
392B
MD54bf2fdb557fec59c515a03029cc7e0c4
SHA104380554a0e22dc7c97839b58d2ab0e4c31ce5e5
SHA25661ff3aa1388b244c44a6c9e8823f216e73516c7c5d20c38a7171ea1432357a32
SHA51225120eb5d68d8d4fe801122d60e014ea5fd4b9af5440917e80671917ca43e25c82af9bbcb26b2a60762ddae8caa6b17fd23aa2400f572353d92d2393c5c6ae7a
-
Filesize
8KB
MD5f5eff4f716427529b003207d5c953df5
SHA179696d6c8d67669ea690d240ef8978672e3d151c
SHA256ac54ebb9eec3212f294462ce012fdc42f4b0896d785d776a5a2cc3599dc5bcde
SHA5125a48599a5855f06c3e7d6f89c4e06bab1f4381b9d30cf3824c465b8fd6c142b316e6bd6aaad73d1f9b3e84d96113fb5e7374831bf503744013c9e1a0632a0caf
-
Filesize
5KB
MD5bc75eddaa64823014fef0fe70bd34ffc
SHA115cd2ace3b68257faed33c78b794b2333eab7c0a
SHA2569eada36d17635bedb85ce96a62cb019dbfee696b9986f69de7d5b5bc1f44df5d
SHA51220db25f32f9cfdbffa4f30c0065125052c6e20b7dcc147fa7ebff38e37b51f6a43e48e486f148d7ee11671479b9fb0bbe1c6df151101af3b50c65fd334d13baa
-
Filesize
4KB
MD513e10cd76f11d6cb43182dcba7370171
SHA1e6b8ce329e49ff09f1cb529c60fc466cb9a579c8
SHA256f1265c88f0077009eaa18db413f156cc7ad8d41dc9d797dd1032b0e0ae9c40d5
SHA512ee32ef3f50838936417e51dfd365b166456900e327dbe51902700bb3d562dea22e6fbd9009c822ba0562687001802a2e61d38123f81ae19f7b3d05bb1fd5cda8
-
Filesize
473KB
MD53c90d45b1c004e86a7f7a7a340f1abc8
SHA110602c450bcbda2735dc036f2e399646f0c64f4c
SHA256f6d9c3bba7fc4dfa681cadf68f41093e3c431501c6789e891e599719e5d2781c
SHA51285457be4c2aa76ede288cd185131d46e5f0b37187313f3a54fe789e28929ec6e44282f4ba0981f46354705cd5da83990586c8846f52fcdb807908254c8719cc1