Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 02:49

General

  • Target

    69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe

  • Size

    478KB

  • MD5

    69fad7d6792450fb7bf97b72852b0b0f

  • SHA1

    9c5ff90156e0041d61fb3b7c522473437a13eb3f

  • SHA256

    25527da024d34cc3015815ddd8e0963705ba67a01ade3d18d0291520efa6b2f8

  • SHA512

    16b6630376c2df716cfeafffe1be3c6529bc44e3500002612a52637f10b951bdd43c3a43227c85ee7d7d28f6d420891034b853bc52d7092430690d4b733f1acb

  • SSDEEP

    12288:N9AQvCxJI4YQ9gF/4UddGpMRrmVkrTXWXBgVOiH2zEx:4QoJI4L9Md/wXBgVwzQ

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\69fad7d6792450fb7bf97b72852b0b0f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Windows\SysWOW64\28463\WUBF.exe
      "C:\Windows\system32\28463\WUBF.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 1116
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:1588
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\WUBF.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1472
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2424 -ip 2424
    1⤵
      PID:3408

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\@B621.tmp

      Filesize

      4KB

      MD5

      908f7f4b0cf93759447afca95cd84aa6

      SHA1

      d1903a49b211bcb4a460904019ee7441420aa961

      SHA256

      3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

      SHA512

      958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

    • C:\Windows\SysWOW64\28463\AKV.exe

      Filesize

      393KB

      MD5

      b0b09699ea39c0107af1c0833f07c054

      SHA1

      b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1

      SHA256

      be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1

      SHA512

      55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796

    • C:\Windows\SysWOW64\28463\WUBF.001

      Filesize

      394B

      MD5

      50286c5ca86842ac5690b6fe4ed2ea2a

      SHA1

      13474fef03d3ef030b3f2c2c78f21557f7604f96

      SHA256

      623518707b4f389a146cf8ac05514da251c0a4cb923f94d5533ff720e411df71

      SHA512

      cbd06f6f8b6be028ca44b8699108bca5f9d95642511cadc7bfcc5f8e7b0b707bde707513a59e16fc1e44c66927f5e4e4822a2bd3cdbe80c92a074ab241ed400c

    • C:\Windows\SysWOW64\28463\WUBF.006

      Filesize

      7KB

      MD5

      e0fcfa7cad88d1a8a462cee6b06cf668

      SHA1

      a7e49078517abc929a6da261df06556c8f5a8cf0

      SHA256

      340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

      SHA512

      430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

    • C:\Windows\SysWOW64\28463\WUBF.007

      Filesize

      5KB

      MD5

      ca72cd485d116033f1b776903ce7ee0a

      SHA1

      85b0b73a75b0498f56200dd1a5cf0de5371e42a3

      SHA256

      e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

      SHA512

      8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

    • C:\Windows\SysWOW64\28463\WUBF.exe

      Filesize

      472KB

      MD5

      d7bd4739313a8e2fc9e080b7d0ba13b2

      SHA1

      808fcbe663bc02780b1d9962873a1e3066d55f05

      SHA256

      c9b47519386b1b7cd6dfecd42e586883d301b7a99c0c3d67a4beabc3ae3dcd6b

      SHA512

      d70e04444a2cc0f5b1fc5c81873b2c93582afa013f9aafe0e7c0eaaac36582b736b6ad8ef23a3d3aa4e3541fd478cbdcb8596dd4d233ada85f861c858c94b398

    • memory/2424-23-0x0000000000630000-0x0000000000631000-memory.dmp

      Filesize

      4KB

    • memory/2424-27-0x0000000000630000-0x0000000000631000-memory.dmp

      Filesize

      4KB