Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    16/07/2024, 06:04

General

  • Target

    4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe

  • Size

    503KB

  • MD5

    4d1729e5a25bdc7bab43b6cdb6ae91ec

  • SHA1

    1f4d90b4b78f0aa15f64281f8a28cbeddc3ce679

  • SHA256

    6bdf99e0672a6231d54b3751b5802c717ab39dc24a102f0b30df66a0955ab260

  • SHA512

    ecd6a842adbcf3db66548a0ff1cda4faf3359269169d08467b32a385246a06f7c818c8cf3c904ea224f523dccdacee0e2f2e6fdfe59be0fe6a36172c5d383210

  • SSDEEP

    12288:ylQRUTV5n8PfCxr31owNStfhhAEjplc3Y49D631iplUNZTmy98uqAdK0mA:UTV5n8CxjS0ajAEtlcj9DiiploUyOuqm

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4d1729e5a25bdc7bab43b6cdb6ae91ec_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2952
    • C:\Windows\SysWOW64\28463\FPBE.exe
      "C:\Windows\system32\28463\FPBE.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:620
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\FPBE.exe > nul
        3⤵
          PID:2584

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\28463\AKV.exe

      Filesize

      395KB

      MD5

      adbec81b510dcfe49835f95940ef961d

      SHA1

      77940f6e46fbd5f53de23bd49afe9172470769d0

      SHA256

      466efb4b00255f21075b340fc2d2444f182947ab90270840543658c5fd3a9b95

      SHA512

      ef4324a06fbe960933f5551ea6ac587cd87cb6025bc6879a2b81a4d1033cfe87e244b6a87fb5db5ad065321ccbe8035cf24a668452d5b0c6a4063a355a12b2a7

    • C:\Windows\SysWOW64\28463\FPBE.001

      Filesize

      392B

      MD5

      4bf2fdb557fec59c515a03029cc7e0c4

      SHA1

      04380554a0e22dc7c97839b58d2ab0e4c31ce5e5

      SHA256

      61ff3aa1388b244c44a6c9e8823f216e73516c7c5d20c38a7171ea1432357a32

      SHA512

      25120eb5d68d8d4fe801122d60e014ea5fd4b9af5440917e80671917ca43e25c82af9bbcb26b2a60762ddae8caa6b17fd23aa2400f572353d92d2393c5c6ae7a

    • C:\Windows\SysWOW64\28463\FPBE.006

      Filesize

      8KB

      MD5

      f5eff4f716427529b003207d5c953df5

      SHA1

      79696d6c8d67669ea690d240ef8978672e3d151c

      SHA256

      ac54ebb9eec3212f294462ce012fdc42f4b0896d785d776a5a2cc3599dc5bcde

      SHA512

      5a48599a5855f06c3e7d6f89c4e06bab1f4381b9d30cf3824c465b8fd6c142b316e6bd6aaad73d1f9b3e84d96113fb5e7374831bf503744013c9e1a0632a0caf

    • C:\Windows\SysWOW64\28463\FPBE.007

      Filesize

      5KB

      MD5

      bc75eddaa64823014fef0fe70bd34ffc

      SHA1

      15cd2ace3b68257faed33c78b794b2333eab7c0a

      SHA256

      9eada36d17635bedb85ce96a62cb019dbfee696b9986f69de7d5b5bc1f44df5d

      SHA512

      20db25f32f9cfdbffa4f30c0065125052c6e20b7dcc147fa7ebff38e37b51f6a43e48e486f148d7ee11671479b9fb0bbe1c6df151101af3b50c65fd334d13baa

    • \Users\Admin\AppData\Local\Temp\@E64A.tmp

      Filesize

      4KB

      MD5

      13e10cd76f11d6cb43182dcba7370171

      SHA1

      e6b8ce329e49ff09f1cb529c60fc466cb9a579c8

      SHA256

      f1265c88f0077009eaa18db413f156cc7ad8d41dc9d797dd1032b0e0ae9c40d5

      SHA512

      ee32ef3f50838936417e51dfd365b166456900e327dbe51902700bb3d562dea22e6fbd9009c822ba0562687001802a2e61d38123f81ae19f7b3d05bb1fd5cda8

    • \Windows\SysWOW64\28463\FPBE.exe

      Filesize

      473KB

      MD5

      3c90d45b1c004e86a7f7a7a340f1abc8

      SHA1

      10602c450bcbda2735dc036f2e399646f0c64f4c

      SHA256

      f6d9c3bba7fc4dfa681cadf68f41093e3c431501c6789e891e599719e5d2781c

      SHA512

      85457be4c2aa76ede288cd185131d46e5f0b37187313f3a54fe789e28929ec6e44282f4ba0981f46354705cd5da83990586c8846f52fcdb807908254c8719cc1

    • memory/620-24-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/620-27-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB