Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-07-2024 00:25

General

  • Target

    71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    71df16f0ffac0e43ae9b8370969d5798

  • SHA1

    910dcb743201f59080f3b801bddbebc4509a1c05

  • SHA256

    b6ddc2c209d0caa662a72bbaf476a7a998f9a1727ca3e573b8115deafde7c42d

  • SHA512

    7a01a43ae040906ca253c79a198568b31c9bd055923fdd5cc2b7682f2ad14f5c33c8de973ba31a34fdfd57da2b09db7c97371b83669f826f81b94e9e8c7429e6

  • SSDEEP

    24576:AHvZTCdSyASAwAUmauDDwWk00NhnSXcS/xtRk:IBTCEIF0E300PSHxt

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3104
    • C:\Windows\SysWOW64\UNWPMW\FID.exe
      "C:\Windows\system32\UNWPMW\FID.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\UNWPMW\AKV.exe

    Filesize

    461KB

    MD5

    eed8ebfafcd3dcb0f88b237388fba8df

    SHA1

    620767d6de979bf360e3a188ed03534c769f337b

    SHA256

    dc3c5152d69547ffb583574707025eee74af46882cdf851221f66b1e81d2ed90

    SHA512

    28148a2bfdbcaf61f5f664c6b4dd0377d151d775ad001818da2bba6327f02020fabb016a4c8aaa5f841ea1dc1a6d8419bca55bc74924a657476e15abbd8dabb3

  • C:\Windows\SysWOW64\UNWPMW\FID.001

    Filesize

    61KB

    MD5

    34c92b717ae97bc926f56ba56a44f24a

    SHA1

    ccaf3c6bf0c73564d0bf19c92b8d25008ffffbfa

    SHA256

    6e60d85b35f5e9222375f606e4116b38364a4a943596ddb0d914cf1cf4791774

    SHA512

    2a9eb63837db128c9e036976d903ebd925e6952ab6bf4efa0e370e79f9fefe0ed6e44e4ab444f56ace1149f4dd14797f568e8827e7cebd1e5581dcf309f9745a

  • C:\Windows\SysWOW64\UNWPMW\FID.002

    Filesize

    43KB

    MD5

    246761f047f6aa98d6eaad66a2f883b9

    SHA1

    42474a5b23d03e094103b62fd7e820457cf807c4

    SHA256

    3774021a3cdf32d23fd5921cea4de8c26b08f0d601f3097550a7e8af7b00f111

    SHA512

    d39d0913975ca2f8d585b72667d76de09ce7817f6de26ef21a8b62edc25d7fab39785f036992d19ca5700f5fc2ee377e696142c41529f23f503e8eefff393144

  • C:\Windows\SysWOW64\UNWPMW\FID.004

    Filesize

    1KB

    MD5

    fdb7458ca2a9845023b1d0418b0c3b55

    SHA1

    b454af8b157bcd0309c8e1a85a713b77553a6957

    SHA256

    a72b6933415df0dabfc78f0528fa9065ff2a4c2bd70fd61dd9fdb6657b5cbaf2

    SHA512

    430d420d7e4d80cc0dfe288942765ac457367831fa4007f1090aacee908a33e62017e125521e4be88d1cab4c11cb269cf3048f51e7a271bc82fedd65218519ea

  • C:\Windows\SysWOW64\UNWPMW\FID.exe

    Filesize

    1.5MB

    MD5

    9ab9b7b74790b7bb2798dd2b26f4a913

    SHA1

    e8ffa981a0149aa6441dcb0dd42f7baf6eb773a2

    SHA256

    df1c8d608ebd300889cf21c3bda6d5dd2574d68e1f530cc5a885449a22177a75

    SHA512

    ffffe21d8cc244aacaaba2eb13cc77ad800a196ecf6f77637a8a1f6d456cabb8331970ab358ab21dcf9832343379b4f0486da3990d45eb2f2765e55b7404739e

  • memory/3244-16-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

  • memory/3244-18-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB