Analysis
-
max time kernel
121s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
69becb50f203005745189b9766f9c18d_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
69becb50f203005745189b9766f9c18d_JaffaCakes118.exe
-
Size
3.7MB
-
MD5
69becb50f203005745189b9766f9c18d
-
SHA1
e1a678ca3eb1b92cfef94a4b36743daf3abdd370
-
SHA256
9a123cb7b8357158b5f9aae0e3210946e3c2fffd97a9a2924ed94928eb078717
-
SHA512
b67cb7cba26836c8d0ca52e81c7f87fb77bc752d54f36a54efe731541af3d34308ebea97cb0d420766c865f8c1a7de05db92bd0678f28b51cd7d7c9c8ea7fc5a
-
SSDEEP
98304:hcSSAW8Koh1oBm9W/YDYWz9yJBj1usJaXkQy:WSxdfCm9WgcWzwBjza0H
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule \Windows\ALNVUA\KBO.exe family_ardamax -
Executes dropped EXE 2 IoCs
Processes:
KBO.exeEngine.exepid process 2504 KBO.exe 2832 Engine.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Engine.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Wine Engine.exe -
Loads dropped DLL 5 IoCs
Processes:
69becb50f203005745189b9766f9c18d_JaffaCakes118.exeKBO.exeEngine.exepid process 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe 2504 KBO.exe 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe 2832 Engine.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
KBO.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KBO Start = "C:\\Windows\\ALNVUA\\KBO.exe" KBO.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Engine.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Engine.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Engine.exepid process 2832 Engine.exe -
Drops file in Windows directory 6 IoCs
Processes:
69becb50f203005745189b9766f9c18d_JaffaCakes118.exeKBO.exedescription ioc process File created C:\Windows\ALNVUA\AKV.exe 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe File created C:\Windows\ALNVUA\KBO.exe 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe File opened for modification C:\Windows\ALNVUA\ KBO.exe File created C:\Windows\ALNVUA\KBO.004 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe File created C:\Windows\ALNVUA\KBO.001 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe File created C:\Windows\ALNVUA\KBO.002 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
69becb50f203005745189b9766f9c18d_JaffaCakes118.exeKBO.exeEngine.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Engine.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Engine.exepid process 2832 Engine.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
KBO.exedescription pid process Token: 33 2504 KBO.exe Token: SeIncBasePriorityPrivilege 2504 KBO.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
KBO.exepid process 2504 KBO.exe 2504 KBO.exe 2504 KBO.exe 2504 KBO.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
69becb50f203005745189b9766f9c18d_JaffaCakes118.exedescription pid process target process PID 2304 wrote to memory of 2504 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe KBO.exe PID 2304 wrote to memory of 2504 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe KBO.exe PID 2304 wrote to memory of 2504 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe KBO.exe PID 2304 wrote to memory of 2504 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe KBO.exe PID 2304 wrote to memory of 2832 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Engine.exe PID 2304 wrote to memory of 2832 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Engine.exe PID 2304 wrote to memory of 2832 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Engine.exe PID 2304 wrote to memory of 2832 2304 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Engine.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69becb50f203005745189b9766f9c18d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69becb50f203005745189b9766f9c18d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\ALNVUA\KBO.exe"C:\Windows\ALNVUA\KBO.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\Engine.exe"C:\Users\Admin\AppData\Local\Temp\Engine.exe"2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
463KB
MD5cf351b0f765da7abc49fa60b03144301
SHA12018df7a0bb13d4d6d9929ad66ab8e033697dd41
SHA2565ad7008ad4202a29b1a45d55625db3c583216934cbac6aa4c1414f69ed8e6693
SHA512545757d3040a1afed3680c4629bc078b26295216b88213fe0f7934d559000bb4f54e3f737bc64301b147980118417ed0e5d03e5d0d28770797e8e37e1cf853f5
-
Filesize
43KB
MD512fb4f589942682a478b7c7881dfcba2
SHA1a3d490c6cda965708a1ff6a0dc4e88037e0d6336
SHA2564de0c277800ae36b85a11ed9765f732a73578d4dce053ff7179f96ab776fb60d
SHA512dd1c6a4ea5bc9698701ec941c4e90fe8dfb0993dc321edc052d1a80cc49bc46be665a85ec678876e698de60cda5dbf1d6279742a16d648f9d18e642a3ea33ddd
-
Filesize
1KB
MD5ac411f814c229d18c9da246ccf791350
SHA177a2058af852e5aab4cda426329a081b41e39a53
SHA25652f676a5ce1c57b7bb7322ccefc1a338afd4082fb6bb8a5a3a9802dd5b262165
SHA512f0583630bf459d5d536caa94fbdf49ebe3bd4802ebf4e10cf156855b82225f63ea25e1f5e2a836ea5b1f508653065f79cdf89294f1dcc8690e37c66dd419f4f3
-
Filesize
2.5MB
MD50a7088290907a546dcfc6f0f46c76911
SHA1f771b96088197ed80a69c71f7fd86bbf5a5529c7
SHA2563034de791af1d7551d95955bce62f46ecd071c0357ceebd3bd75d3e98dc7860a
SHA512eb6e7aa9e27f814e12f35677de31006421dadbd112a168b89b4b2586c95f566caec14cf7af103c99fccf32a9950004ad490b103624cc7e1f07aadbd63969897d
-
Filesize
61KB
MD5b8cb0e28a65b57b7633a043ffdd0721b
SHA14aeaed92614d0a1fd64ae6c1e85a655de4570884
SHA256678f7579dd4f01bd9837aece3fd6a8634d16e7bcc6583cf7764212fae4170a8b
SHA512c781b4c4f86f036b4443a8af0072e59f23c54d20e44c1ee068dacd7ac0f7e324192cccb64a158db3000c78994da826e8394587ef8144b83179b5cc531120e2ab
-
Filesize
1.5MB
MD5f8530f0dfe90c7c1e20239b0a7643041
SHA13e0208ab84b8444a69c8d62ad0b81c4186395802
SHA256734439c4049ae1a832b4cc5c8d227112106406945d1a7cbb355e11a3f5e356c4
SHA5125cb01517938789e006e00d69729ae7d73ad480f1ae17a80059bf81ee5d9cebb1263a35732c84f03d742684a650b116b13e6731ca80b0b9cdb3908e5588649399