Analysis
-
max time kernel
133s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 23:30
Static task
static1
Behavioral task
behavioral1
Sample
6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
6d3fe2ce99e8e3026722408de85de279
-
SHA1
f1a45deab537675c7d640a89eb62993fb751464f
-
SHA256
68e69915f8982a6434cdde031aa9ec143f1fd2c59e6143e83351d58df5af1ba0
-
SHA512
654c4cc894347bf627e64bc261484df30f513478030ce0d6e63d74fe6cfe58b88b91a123d3459ededeab542140baabcfb3e6346a5b0b7a3cf9be10e712aeb9e2
-
SSDEEP
24576:bnhOVrZDxZV2xvqCeGUZmxZ9IVxJAWDyEoLfKLAkFao6ijVTBow:DhoVaCvGUZmtwxJAqGXkF4WVT7
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\UQIFYW\HVY.exe family_ardamax -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exeHVY.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation HVY.exe -
Executes dropped EXE 1 IoCs
Processes:
HVY.exepid process 4920 HVY.exe -
Loads dropped DLL 1 IoCs
Processes:
HVY.exepid process 4920 HVY.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HVY.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HVY Start = "C:\\Windows\\SysWOW64\\UQIFYW\\HVY.exe" HVY.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 6 IoCs
Processes:
HVY.exe6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\UQIFYW\ HVY.exe File created C:\Windows\SysWOW64\UQIFYW\HVY.004 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe File created C:\Windows\SysWOW64\UQIFYW\HVY.001 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe File created C:\Windows\SysWOW64\UQIFYW\HVY.002 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe File created C:\Windows\SysWOW64\UQIFYW\AKV.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe File created C:\Windows\SysWOW64\UQIFYW\HVY.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exedescription pid process target process PID 4336 set thread context of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exeHVY.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
HVY.exedescription pid process Token: 33 4920 HVY.exe Token: SeIncBasePriorityPrivilege 4920 HVY.exe Token: SeIncBasePriorityPrivilege 4920 HVY.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exeHVY.exepid process 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 4920 HVY.exe 4920 HVY.exe 4920 HVY.exe 4920 HVY.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exeHVY.exedescription pid process target process PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 4336 wrote to memory of 208 4336 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe PID 208 wrote to memory of 4920 208 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe HVY.exe PID 208 wrote to memory of 4920 208 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe HVY.exe PID 208 wrote to memory of 4920 208 6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe HVY.exe PID 4920 wrote to memory of 3692 4920 HVY.exe cmd.exe PID 4920 wrote to memory of 3692 4920 HVY.exe cmd.exe PID 4920 wrote to memory of 3692 4920 HVY.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\6d3fe2ce99e8e3026722408de85de279_JaffaCakes118.exe2⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\UQIFYW\HVY.exe"C:\Windows\system32\UQIFYW\HVY.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\UQIFYW\HVY.exe > nul4⤵
- System Location Discovery: System Language Discovery
PID:3692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD551507d91d43683b9c4b8fafeb4d888f8
SHA1ead2f68338da7af4720378cd46133589fc9405ba
SHA25671b3aecefd36e4855a369019ac5871c544d39f8889d23cd455466a24cdecce6b
SHA512a5a7ff3f8ffb72719b7e2c9dc2719c99ea32bd68994918ea027c0d7d54cfe0c80bfd34486dd8d3cdd390376bc4c8d1f7d97de4b98b7d39a3e10c3e2682c07d1c
-
Filesize
61KB
MD5383d5f5d4240d590e7dec3f7312a4ac7
SHA1f6bcade8d37afb80cf52a89b3e84683f4643fbce
SHA2567e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422
SHA512e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a
-
Filesize
43KB
MD593df156c4bd9d7341f4c4a4847616a69
SHA1c7663b32c3c8e247bc16b51aff87b45484652dc1
SHA256e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e
SHA512ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35
-
Filesize
1KB
MD5fbb16ac078d82071059ed73ebf83316f
SHA1c4c6506f888c069ee2b8300d2c8df69eeb76ec98
SHA256d6cdcc50e7f948afa7f542ef320520fbc6f505c2139683e2b70018909af9ac26
SHA512634027b9a6741dca601d39a72d241ffa8a2c57c3649beab707b208b1bb64b19f8c181e4c04d32f723cb52cd9723158b22e6baf993dcf7f866d100794d414ab78
-
Filesize
1.7MB
MD53cd29c0df98a7aeb69a9692843ca3edb
SHA17c86aea093f1979d18901bd1b89a2b02a60ac3e2
SHA2565a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32
SHA512e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9