Analysis

  • max time kernel
    94s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 14:59

General

  • Target

    7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe

  • Size

    452KB

  • MD5

    7011f033fa7b95b0ec90a6ee1e3c3bd9

  • SHA1

    59e285d76eedce8322922a00b2e9f1c9566c95a7

  • SHA256

    4a143baf691f9d5edc1694cbb3c232d41d5650d62af636ecc5d31ba9467ae4fd

  • SHA512

    2af9212c9ba71cbb934f766a955a905bc24cd0c68d5ad9bd6fd0fec24bafef54db793d8ac3c6af0ff5f62ac6404a9dcc7aab24db65d5f55d6e2464a2098365b6

  • SSDEEP

    12288:jvA3w0LwVXNVGON3X1ah5xStw6omh8ywa0sS8uu:j0whHRNu5wevmhPh9

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7011f033fa7b95b0ec90a6ee1e3c3bd9_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
      "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Windows\SysWOW64\28463\NPEW.exe
        "C:\Windows\system32\28463\NPEW.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\jI82l\PCGWIN32.LI5

    Filesize

    2KB

    MD5

    535616f9afecac5c1a47408af7714148

    SHA1

    1266a18c1f894e9df061982a13db60e57d1f8031

    SHA256

    8a9fb81cedfc54e8bb248da8200dd728ca50495687131fd956a7172bcedf02c7

    SHA512

    2f4f41a36fba9796c367e8236bb162f5161caf9e537c600938a320c54cc1660f420210ec6fb2a85210e79127d8e0ebcb3a5710dfe4e8a6b00ada10317c5bfa90

  • C:\Users\Admin\AppData\Local\Temp\@E733.tmp

    Filesize

    4KB

    MD5

    c3679c3ff636d1a6b8c65323540da371

    SHA1

    d184758721a426467b687bec2a4acc80fe44c6f8

    SHA256

    d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb

    SHA512

    494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

  • C:\Users\Admin\AppData\Local\Temp\Exporer32.exe

    Filesize

    280KB

    MD5

    a2754b0d71cbe981df8657e277a42d02

    SHA1

    f5184d67a3744a70323cb8b89fc8aef73231be6e

    SHA256

    9217b464a2560e1be585bbce827393d600050817718d554f217f6fbcac8fbce2

    SHA512

    03c8be0b464759cbea7ae82a3e8dbb6773c3dc9dbc383dfcf6bbd63ec173d3d407d40d1ee2d70d9127fbb544ab3131040a513940cc218f09ef6dcd89d31ddc2d

  • C:\Windows\SysWOW64\28463\NPEW.001

    Filesize

    400B

    MD5

    0a747bd4a40df520c0efdd7af400c17c

    SHA1

    9559c863d76dca319b7c99f49ce16c03c6701142

    SHA256

    8512698e9ed8a5bb4b06ed6d65ef98921c15716369fc7a2f9dfb1adbdb06b6be

    SHA512

    f5400244833caa2f76d8468f0eefe8f311c2033a557d46a04024eea8f37d8468063effc055bc38b52c58c3481055e2c9130beed4622aed6e7690cffda31db0c4

  • C:\Windows\SysWOW64\28463\NPEW.006

    Filesize

    8KB

    MD5

    43f02e9974b1477c1e6388882f233db0

    SHA1

    f3e27b231193f8d5b2e1b09d05ae3a62795cf339

    SHA256

    3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba

    SHA512

    e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

  • C:\Windows\SysWOW64\28463\NPEW.007

    Filesize

    5KB

    MD5

    b5a87d630436f958c6e1d82d15f98f96

    SHA1

    d3ff5e92198d4df0f98a918071aca53550bf1cff

    SHA256

    a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2

    SHA512

    fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

  • C:\Windows\SysWOW64\28463\NPEW.exe

    Filesize

    473KB

    MD5

    17535dddecf8cb1efdba1f1952126547

    SHA1

    a862a9a3eb6c201751be1038537522a5281ea6cb

    SHA256

    1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd

    SHA512

    b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

  • memory/1444-0-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1444-32-0x0000000000400000-0x000000000042B000-memory.dmp

    Filesize

    172KB

  • memory/1508-45-0x0000000000640000-0x0000000000641000-memory.dmp

    Filesize

    4KB

  • memory/1508-49-0x0000000000640000-0x0000000000641000-memory.dmp

    Filesize

    4KB