Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 00:25
Static task
static1
Behavioral task
behavioral1
Sample
71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
71df16f0ffac0e43ae9b8370969d5798
-
SHA1
910dcb743201f59080f3b801bddbebc4509a1c05
-
SHA256
b6ddc2c209d0caa662a72bbaf476a7a998f9a1727ca3e573b8115deafde7c42d
-
SHA512
7a01a43ae040906ca253c79a198568b31c9bd055923fdd5cc2b7682f2ad14f5c33c8de973ba31a34fdfd57da2b09db7c97371b83669f826f81b94e9e8c7429e6
-
SSDEEP
24576:AHvZTCdSyASAwAUmauDDwWk00NhnSXcS/xtRk:IBTCEIF0E300PSHxt
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\UNWPMW\FID.exe family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
FID.exepid process 3244 FID.exe -
Loads dropped DLL 1 IoCs
Processes:
FID.exepid process 3244 FID.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
FID.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FID Start = "C:\\Windows\\SysWOW64\\UNWPMW\\FID.exe" FID.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exeFID.exedescription ioc process File created C:\Windows\SysWOW64\UNWPMW\FID.004 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe File created C:\Windows\SysWOW64\UNWPMW\FID.001 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe File created C:\Windows\SysWOW64\UNWPMW\FID.002 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe File created C:\Windows\SysWOW64\UNWPMW\AKV.exe 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe File created C:\Windows\SysWOW64\UNWPMW\FID.exe 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\UNWPMW\ FID.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exeFID.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FID.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
FID.exedescription pid process Token: 33 3244 FID.exe Token: SeIncBasePriorityPrivilege 3244 FID.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
FID.exepid process 3244 FID.exe 3244 FID.exe 3244 FID.exe 3244 FID.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exedescription pid process target process PID 3104 wrote to memory of 3244 3104 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe FID.exe PID 3104 wrote to memory of 3244 3104 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe FID.exe PID 3104 wrote to memory of 3244 3104 71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe FID.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\71df16f0ffac0e43ae9b8370969d5798_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\UNWPMW\FID.exe"C:\Windows\system32\UNWPMW\FID.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
461KB
MD5eed8ebfafcd3dcb0f88b237388fba8df
SHA1620767d6de979bf360e3a188ed03534c769f337b
SHA256dc3c5152d69547ffb583574707025eee74af46882cdf851221f66b1e81d2ed90
SHA51228148a2bfdbcaf61f5f664c6b4dd0377d151d775ad001818da2bba6327f02020fabb016a4c8aaa5f841ea1dc1a6d8419bca55bc74924a657476e15abbd8dabb3
-
Filesize
61KB
MD534c92b717ae97bc926f56ba56a44f24a
SHA1ccaf3c6bf0c73564d0bf19c92b8d25008ffffbfa
SHA2566e60d85b35f5e9222375f606e4116b38364a4a943596ddb0d914cf1cf4791774
SHA5122a9eb63837db128c9e036976d903ebd925e6952ab6bf4efa0e370e79f9fefe0ed6e44e4ab444f56ace1149f4dd14797f568e8827e7cebd1e5581dcf309f9745a
-
Filesize
43KB
MD5246761f047f6aa98d6eaad66a2f883b9
SHA142474a5b23d03e094103b62fd7e820457cf807c4
SHA2563774021a3cdf32d23fd5921cea4de8c26b08f0d601f3097550a7e8af7b00f111
SHA512d39d0913975ca2f8d585b72667d76de09ce7817f6de26ef21a8b62edc25d7fab39785f036992d19ca5700f5fc2ee377e696142c41529f23f503e8eefff393144
-
Filesize
1KB
MD5fdb7458ca2a9845023b1d0418b0c3b55
SHA1b454af8b157bcd0309c8e1a85a713b77553a6957
SHA256a72b6933415df0dabfc78f0528fa9065ff2a4c2bd70fd61dd9fdb6657b5cbaf2
SHA512430d420d7e4d80cc0dfe288942765ac457367831fa4007f1090aacee908a33e62017e125521e4be88d1cab4c11cb269cf3048f51e7a271bc82fedd65218519ea
-
Filesize
1.5MB
MD59ab9b7b74790b7bb2798dd2b26f4a913
SHA1e8ffa981a0149aa6441dcb0dd42f7baf6eb773a2
SHA256df1c8d608ebd300889cf21c3bda6d5dd2574d68e1f530cc5a885449a22177a75
SHA512ffffe21d8cc244aacaaba2eb13cc77ad800a196ecf6f77637a8a1f6d456cabb8331970ab358ab21dcf9832343379b4f0486da3990d45eb2f2765e55b7404739e