Analysis
-
max time kernel
135s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
69becb50f203005745189b9766f9c18d_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
69becb50f203005745189b9766f9c18d_JaffaCakes118.exe
-
Size
3.7MB
-
MD5
69becb50f203005745189b9766f9c18d
-
SHA1
e1a678ca3eb1b92cfef94a4b36743daf3abdd370
-
SHA256
9a123cb7b8357158b5f9aae0e3210946e3c2fffd97a9a2924ed94928eb078717
-
SHA512
b67cb7cba26836c8d0ca52e81c7f87fb77bc752d54f36a54efe731541af3d34308ebea97cb0d420766c865f8c1a7de05db92bd0678f28b51cd7d7c9c8ea7fc5a
-
SSDEEP
98304:hcSSAW8Koh1oBm9W/YDYWz9yJBj1usJaXkQy:WSxdfCm9WgcWzwBjza0H
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\ALNVUA\KBO.exe family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
69becb50f203005745189b9766f9c18d_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
KBO.exeEngine.exepid process 4028 KBO.exe 4352 Engine.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
Engine.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Wine Engine.exe -
Loads dropped DLL 2 IoCs
Processes:
KBO.exeEngine.exepid process 4028 KBO.exe 4352 Engine.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
KBO.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KBO Start = "C:\\Windows\\ALNVUA\\KBO.exe" KBO.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Engine.exepid process 4352 Engine.exe -
Drops file in Windows directory 6 IoCs
Processes:
69becb50f203005745189b9766f9c18d_JaffaCakes118.exeKBO.exedescription ioc process File created C:\Windows\ALNVUA\KBO.exe 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe File opened for modification C:\Windows\ALNVUA\ KBO.exe File created C:\Windows\ALNVUA\KBO.004 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe File created C:\Windows\ALNVUA\KBO.001 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe File created C:\Windows\ALNVUA\KBO.002 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe File created C:\Windows\ALNVUA\AKV.exe 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
69becb50f203005745189b9766f9c18d_JaffaCakes118.exeKBO.exeEngine.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Engine.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1403246978-718555486-3105247137-1000\{4A210D43-2757-4BCC-99EB-D93BA4827808} svchost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1403246978-718555486-3105247137-1000\{3F5D6E69-9F29-4788-BDE7-41A71F57CB49} svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Engine.exepid process 4352 Engine.exe 4352 Engine.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
KBO.exedescription pid process Token: 33 4028 KBO.exe Token: SeIncBasePriorityPrivilege 4028 KBO.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
KBO.exeOpenWith.exepid process 4028 KBO.exe 4028 KBO.exe 4028 KBO.exe 4028 KBO.exe 3236 OpenWith.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
69becb50f203005745189b9766f9c18d_JaffaCakes118.exedescription pid process target process PID 1216 wrote to memory of 4028 1216 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe KBO.exe PID 1216 wrote to memory of 4028 1216 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe KBO.exe PID 1216 wrote to memory of 4028 1216 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe KBO.exe PID 1216 wrote to memory of 4352 1216 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Engine.exe PID 1216 wrote to memory of 4352 1216 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Engine.exe PID 1216 wrote to memory of 4352 1216 69becb50f203005745189b9766f9c18d_JaffaCakes118.exe Engine.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69becb50f203005745189b9766f9c18d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69becb50f203005745189b9766f9c18d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\ALNVUA\KBO.exe"C:\Windows\ALNVUA\KBO.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\Engine.exe"C:\Users\Admin\AppData\Local\Temp\Engine.exe"2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4352
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3236
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
PID:3148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD50a7088290907a546dcfc6f0f46c76911
SHA1f771b96088197ed80a69c71f7fd86bbf5a5529c7
SHA2563034de791af1d7551d95955bce62f46ecd071c0357ceebd3bd75d3e98dc7860a
SHA512eb6e7aa9e27f814e12f35677de31006421dadbd112a168b89b4b2586c95f566caec14cf7af103c99fccf32a9950004ad490b103624cc7e1f07aadbd63969897d
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
463KB
MD5cf351b0f765da7abc49fa60b03144301
SHA12018df7a0bb13d4d6d9929ad66ab8e033697dd41
SHA2565ad7008ad4202a29b1a45d55625db3c583216934cbac6aa4c1414f69ed8e6693
SHA512545757d3040a1afed3680c4629bc078b26295216b88213fe0f7934d559000bb4f54e3f737bc64301b147980118417ed0e5d03e5d0d28770797e8e37e1cf853f5
-
Filesize
61KB
MD5b8cb0e28a65b57b7633a043ffdd0721b
SHA14aeaed92614d0a1fd64ae6c1e85a655de4570884
SHA256678f7579dd4f01bd9837aece3fd6a8634d16e7bcc6583cf7764212fae4170a8b
SHA512c781b4c4f86f036b4443a8af0072e59f23c54d20e44c1ee068dacd7ac0f7e324192cccb64a158db3000c78994da826e8394587ef8144b83179b5cc531120e2ab
-
Filesize
43KB
MD512fb4f589942682a478b7c7881dfcba2
SHA1a3d490c6cda965708a1ff6a0dc4e88037e0d6336
SHA2564de0c277800ae36b85a11ed9765f732a73578d4dce053ff7179f96ab776fb60d
SHA512dd1c6a4ea5bc9698701ec941c4e90fe8dfb0993dc321edc052d1a80cc49bc46be665a85ec678876e698de60cda5dbf1d6279742a16d648f9d18e642a3ea33ddd
-
Filesize
1KB
MD5ac411f814c229d18c9da246ccf791350
SHA177a2058af852e5aab4cda426329a081b41e39a53
SHA25652f676a5ce1c57b7bb7322ccefc1a338afd4082fb6bb8a5a3a9802dd5b262165
SHA512f0583630bf459d5d536caa94fbdf49ebe3bd4802ebf4e10cf156855b82225f63ea25e1f5e2a836ea5b1f508653065f79cdf89294f1dcc8690e37c66dd419f4f3
-
Filesize
1.5MB
MD5f8530f0dfe90c7c1e20239b0a7643041
SHA13e0208ab84b8444a69c8d62ad0b81c4186395802
SHA256734439c4049ae1a832b4cc5c8d227112106406945d1a7cbb355e11a3f5e356c4
SHA5125cb01517938789e006e00d69729ae7d73ad480f1ae17a80059bf81ee5d9cebb1263a35732c84f03d742684a650b116b13e6731ca80b0b9cdb3908e5588649399