Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25-07-2024 14:59
Static task
static1
Behavioral task
behavioral1
Sample
7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe
-
Size
452KB
-
MD5
7011f033fa7b95b0ec90a6ee1e3c3bd9
-
SHA1
59e285d76eedce8322922a00b2e9f1c9566c95a7
-
SHA256
4a143baf691f9d5edc1694cbb3c232d41d5650d62af636ecc5d31ba9467ae4fd
-
SHA512
2af9212c9ba71cbb934f766a955a905bc24cd0c68d5ad9bd6fd0fec24bafef54db793d8ac3c6af0ff5f62ac6404a9dcc7aab24db65d5f55d6e2464a2098365b6
-
SSDEEP
12288:jvA3w0LwVXNVGON3X1ah5xStw6omh8ywa0sS8uu:j0whHRNu5wevmhPh9
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\28463\NPEW.exe family_ardamax -
Executes dropped EXE 2 IoCs
Processes:
Exporer32.exeNPEW.exepid process 768 Exporer32.exe 2724 NPEW.exe -
Loads dropped DLL 7 IoCs
Processes:
7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exeExporer32.exeNPEW.exepid process 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 768 Exporer32.exe 768 Exporer32.exe 768 Exporer32.exe 2724 NPEW.exe 2724 NPEW.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NPEW.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NPEW Agent = "C:\\Windows\\SysWOW64\\28463\\NPEW.exe" NPEW.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
Exporer32.exeNPEW.exedescription ioc process File created C:\Windows\SysWOW64\28463\NPEW.001 Exporer32.exe File created C:\Windows\SysWOW64\28463\NPEW.006 Exporer32.exe File created C:\Windows\SysWOW64\28463\NPEW.007 Exporer32.exe File created C:\Windows\SysWOW64\28463\NPEW.exe Exporer32.exe File opened for modification C:\Windows\SysWOW64\28463 NPEW.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exeExporer32.exeNPEW.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exporer32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPEW.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exepid process 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NPEW.exedescription pid process Token: 33 2724 NPEW.exe Token: SeIncBasePriorityPrivilege 2724 NPEW.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exeNPEW.exepid process 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe 2724 NPEW.exe 2724 NPEW.exe 2724 NPEW.exe 2724 NPEW.exe 2724 NPEW.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exeExporer32.exedescription pid process target process PID 2160 wrote to memory of 768 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe Exporer32.exe PID 2160 wrote to memory of 768 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe Exporer32.exe PID 2160 wrote to memory of 768 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe Exporer32.exe PID 2160 wrote to memory of 768 2160 7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe Exporer32.exe PID 768 wrote to memory of 2724 768 Exporer32.exe NPEW.exe PID 768 wrote to memory of 2724 768 Exporer32.exe NPEW.exe PID 768 wrote to memory of 2724 768 Exporer32.exe NPEW.exe PID 768 wrote to memory of 2724 768 Exporer32.exe NPEW.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\28463\NPEW.exe"C:\Windows\system32\28463\NPEW.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54ecbe741bb2676d0147e1103ac18dfcd
SHA134b037e313dd0479c14bc51181ad059a74947b75
SHA2561d1177f03c08284e1598ec92a67dd2f021d5b8cdb39c1d7a87ac348c6a3efef0
SHA512e33492d6975c838a2fc4914c2b6afdc7ec0e6db5a6966108daf7af248e65c1b0396d27c114385f55909e70229535379736c936639c27d7f66a95f56e9103a5a8
-
Filesize
400B
MD50a747bd4a40df520c0efdd7af400c17c
SHA19559c863d76dca319b7c99f49ce16c03c6701142
SHA2568512698e9ed8a5bb4b06ed6d65ef98921c15716369fc7a2f9dfb1adbdb06b6be
SHA512f5400244833caa2f76d8468f0eefe8f311c2033a557d46a04024eea8f37d8468063effc055bc38b52c58c3481055e2c9130beed4622aed6e7690cffda31db0c4
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
280KB
MD5a2754b0d71cbe981df8657e277a42d02
SHA1f5184d67a3744a70323cb8b89fc8aef73231be6e
SHA2569217b464a2560e1be585bbce827393d600050817718d554f217f6fbcac8fbce2
SHA51203c8be0b464759cbea7ae82a3e8dbb6773c3dc9dbc383dfcf6bbd63ec173d3d407d40d1ee2d70d9127fbb544ab3131040a513940cc218f09ef6dcd89d31ddc2d
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8