Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 02:49
Static task
static1
Behavioral task
behavioral1
Sample
69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe
-
Size
478KB
-
MD5
69fad7d6792450fb7bf97b72852b0b0f
-
SHA1
9c5ff90156e0041d61fb3b7c522473437a13eb3f
-
SHA256
25527da024d34cc3015815ddd8e0963705ba67a01ade3d18d0291520efa6b2f8
-
SHA512
16b6630376c2df716cfeafffe1be3c6529bc44e3500002612a52637f10b951bdd43c3a43227c85ee7d7d28f6d420891034b853bc52d7092430690d4b733f1acb
-
SSDEEP
12288:N9AQvCxJI4YQ9gF/4UddGpMRrmVkrTXWXBgVOiH2zEx:4QoJI4L9Md/wXBgVwzQ
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\28463\WUBF.exe family_ardamax -
Executes dropped EXE 1 IoCs
Processes:
WUBF.exepid process 2828 WUBF.exe -
Loads dropped DLL 5 IoCs
Processes:
69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exeWUBF.exepid process 3056 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe 3056 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe 3056 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe 2828 WUBF.exe 2828 WUBF.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WUBF.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WUBF Agent = "C:\\Windows\\SysWOW64\\28463\\WUBF.exe" WUBF.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 6 IoCs
Processes:
69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exeWUBF.exedescription ioc process File created C:\Windows\SysWOW64\28463\WUBF.006 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\WUBF.007 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\WUBF.exe 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AKV.exe 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 WUBF.exe File created C:\Windows\SysWOW64\28463\WUBF.001 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exeWUBF.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WUBF.exedescription pid process Token: 33 2828 WUBF.exe Token: SeIncBasePriorityPrivilege 2828 WUBF.exe Token: SeIncBasePriorityPrivilege 2828 WUBF.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WUBF.exepid process 2828 WUBF.exe 2828 WUBF.exe 2828 WUBF.exe 2828 WUBF.exe 2828 WUBF.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exeWUBF.exedescription pid process target process PID 3056 wrote to memory of 2828 3056 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe WUBF.exe PID 3056 wrote to memory of 2828 3056 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe WUBF.exe PID 3056 wrote to memory of 2828 3056 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe WUBF.exe PID 3056 wrote to memory of 2828 3056 69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe WUBF.exe PID 2828 wrote to memory of 788 2828 WUBF.exe cmd.exe PID 2828 wrote to memory of 788 2828 WUBF.exe cmd.exe PID 2828 wrote to memory of 788 2828 WUBF.exe cmd.exe PID 2828 wrote to memory of 788 2828 WUBF.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\28463\WUBF.exe"C:\Windows\system32\28463\WUBF.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\WUBF.exe > nul3⤵
- System Location Discovery: System Language Discovery
PID:788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
393KB
MD5b0b09699ea39c0107af1c0833f07c054
SHA1b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1
SHA256be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1
SHA51255430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796
-
Filesize
394B
MD550286c5ca86842ac5690b6fe4ed2ea2a
SHA113474fef03d3ef030b3f2c2c78f21557f7604f96
SHA256623518707b4f389a146cf8ac05514da251c0a4cb923f94d5533ff720e411df71
SHA512cbd06f6f8b6be028ca44b8699108bca5f9d95642511cadc7bfcc5f8e7b0b707bde707513a59e16fc1e44c66927f5e4e4822a2bd3cdbe80c92a074ab241ed400c
-
Filesize
7KB
MD5e0fcfa7cad88d1a8a462cee6b06cf668
SHA1a7e49078517abc929a6da261df06556c8f5a8cf0
SHA256340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4
SHA512430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82
-
Filesize
5KB
MD5ca72cd485d116033f1b776903ce7ee0a
SHA185b0b73a75b0498f56200dd1a5cf0de5371e42a3
SHA256e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4
SHA5128dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f
-
Filesize
4KB
MD5908f7f4b0cf93759447afca95cd84aa6
SHA1d1903a49b211bcb4a460904019ee7441420aa961
SHA2563e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23
SHA512958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d
-
Filesize
472KB
MD5d7bd4739313a8e2fc9e080b7d0ba13b2
SHA1808fcbe663bc02780b1d9962873a1e3066d55f05
SHA256c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b
SHA512d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398