Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2024 02:49

General

  • Target

    69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe

  • Size

    478KB

  • MD5

    69fad7d6792450fb7bf97b72852b0b0f

  • SHA1

    9c5ff90156e0041d61fb3b7c522473437a13eb3f

  • SHA256

    25527da024d34cc3015815ddd8e0963705ba67a01ade3d18d0291520efa6b2f8

  • SHA512

    16b6630376c2df716cfeafffe1be3c6529bc44e3500002612a52637f10b951bdd43c3a43227c85ee7d7d28f6d420891034b853bc52d7092430690d4b733f1acb

  • SSDEEP

    12288:N9AQvCxJI4YQ9gF/4UddGpMRrmVkrTXWXBgVOiH2zEx:4QoJI4L9Md/wXBgVwzQ

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\SysWOW64\28463\WUBF.exe
      "C:\Windows\system32\28463\WUBF.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\WUBF.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    393KB

    MD5

    b0b09699ea39c0107af1c0833f07c054

    SHA1

    b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1

    SHA256

    be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1

    SHA512

    55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796

  • C:\Windows\SysWOW64\28463\WUBF.001

    Filesize

    394B

    MD5

    50286c5ca86842ac5690b6fe4ed2ea2a

    SHA1

    13474fef03d3ef030b3f2c2c78f21557f7604f96

    SHA256

    623518707b4f389a146cf8ac05514da251c0a4cb923f94d5533ff720e411df71

    SHA512

    cbd06f6f8b6be028ca44b8699108bca5f9d95642511cadc7bfcc5f8e7b0b707bde707513a59e16fc1e44c66927f5e4e4822a2bd3cdbe80c92a074ab241ed400c

  • C:\Windows\SysWOW64\28463\WUBF.006

    Filesize

    7KB

    MD5

    e0fcfa7cad88d1a8a462cee6b06cf668

    SHA1

    a7e49078517abc929a6da261df06556c8f5a8cf0

    SHA256

    340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

    SHA512

    430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

  • C:\Windows\SysWOW64\28463\WUBF.007

    Filesize

    5KB

    MD5

    ca72cd485d116033f1b776903ce7ee0a

    SHA1

    85b0b73a75b0498f56200dd1a5cf0de5371e42a3

    SHA256

    e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

    SHA512

    8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

  • \Users\Admin\AppData\Local\Temp\@79C2.tmp

    Filesize

    4KB

    MD5

    908f7f4b0cf93759447afca95cd84aa6

    SHA1

    d1903a49b211bcb4a460904019ee7441420aa961

    SHA256

    3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

    SHA512

    958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

  • \Windows\SysWOW64\28463\WUBF.exe

    Filesize

    472KB

    MD5

    d7bd4739313a8e2fc9e080b7d0ba13b2

    SHA1

    808fcbe663bc02780b1d9962873a1e3066d55f05

    SHA256

    c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b

    SHA512

    d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398

  • memory/2828-25-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB