Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 06:22
Static task
static1
Behavioral task
behavioral1
Sample
72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe
-
Size
791KB
-
MD5
72e8fac6c5dd8b5a108640182806fe3c
-
SHA1
4dcd968444b95b6cc4dbbdaa4cf280db3875a93b
-
SHA256
6c96462b8d07f48077c81df376233872b5f1b2e53739b02b244f51e53c2e5390
-
SHA512
f69d1f4e765202d2c85b9ff2cee15c64f016df0bde2ac96a15ad6fa3012aac8ba9d4032215b7275f97735397b0224f2e50cae4945190a3df7c5a6824538c83c5
-
SSDEEP
24576:T6Aw73qXg9mLPmTfex7ujMz6WZ/u7+qO02iT:Tcegnfexa4z6E0j
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\28463\IBJU.exe family_ardamax -
Executes dropped EXE 1 IoCs
Processes:
IBJU.exepid process 2696 IBJU.exe -
Loads dropped DLL 6 IoCs
Processes:
72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exeIBJU.exeDllHost.exepid process 2316 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe 2316 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe 2696 IBJU.exe 2696 IBJU.exe 2708 DllHost.exe 2708 DllHost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
IBJU.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IBJU Agent = "C:\\Windows\\SysWOW64\\28463\\IBJU.exe" IBJU.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
Processes:
72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exeIBJU.exedescription ioc process File created C:\Windows\SysWOW64\28463\AKV.exe 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 IBJU.exe File created C:\Windows\SysWOW64\28463\IBJU.001 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\IBJU.006 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\IBJU.007 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\IBJU.exe 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\key.bin 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exeIBJU.exeDllHost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
Modifies registry class 43 IoCs
Processes:
IBJU.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\EnablePlugin\ IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\InProcServer32\ IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\PersistentHandler IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\PersistentHandler\ IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\ IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24} IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\DefaultIcon\ IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\MiscStatus\ IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\PersistentHandler\ = "{eec97550-47a9-11cf-b952-00aa0051fe20}" IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0 IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\0\win32\ IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\TypeLib\ IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\InProcServer32\ = "C:\\Windows\\SysWOW64\\mshtml.dll" IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\ProgID IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\ProgID\ = "htmlfile" IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\ = "GrooveProjectMeetingDataDelegate" IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\0\win32 IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\43" IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\" IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\BrowseInPlace\ IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\DefaultIcon IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\TypeLib IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\TypeLib\ = "{CEEFA37A-066B-16E7-ABA1-74970AAAB354}" IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\BrowseInPlace IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\MiscStatus\ = "2228625" IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\ IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\0\ IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\Version IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\EnablePlugin IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\MiscStatus IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\0 IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\FLAGS IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\FLAGS\ IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\HELPDIR IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\InProcServer32 IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\ProgID\ IBJU.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354} IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\Version\ IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\Version\ = "4.0" IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\ = "Ivifaw Object" IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0654D4-9E2B-4955-4091-70A41DA4EE24}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe,-19" IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\FLAGS\ = "4" IBJU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CEEFA37A-066B-16E7-ABA1-74970AAAB354}\1.0\HELPDIR\ IBJU.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
IBJU.exedescription pid process Token: 33 2696 IBJU.exe Token: SeIncBasePriorityPrivilege 2696 IBJU.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 2708 DllHost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
IBJU.exepid process 2696 IBJU.exe 2696 IBJU.exe 2696 IBJU.exe 2696 IBJU.exe 2696 IBJU.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exedescription pid process target process PID 2316 wrote to memory of 2696 2316 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe IBJU.exe PID 2316 wrote to memory of 2696 2316 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe IBJU.exe PID 2316 wrote to memory of 2696 2316 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe IBJU.exe PID 2316 wrote to memory of 2696 2316 72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe IBJU.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72e8fac6c5dd8b5a108640182806fe3c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\28463\IBJU.exe"C:\Windows\system32\28463\IBJU.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2696
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5095e4b11bc07acedf9eacb0195819280
SHA186a292d3a4a6d03df8b823d639ad9e95b1bd9b27
SHA256f8a0b0d19e121157d2a5ded950f541bd23348b17dffdbcbcb7b92b904554bc0a
SHA51248c3ef9375cbbdac157eb369080bcda6a46f7989dd781adddb60ab9320b95ad087222893b120c74f4770296b8fc80c6a8fca924af8359c843a335c0bbcb110dc
-
Filesize
457KB
MD5f34b87951e1a931e01df1bc9f1b98207
SHA1f3cc94e72bf7e9bf2afa7d8dbfef0ca2087358a1
SHA256e6cf7cdc5895da8a65f8c4a1a1d0d0583218a1c28f66d25dc56fa67f9c34ed5b
SHA512c2438d88489b9ed7c6c875ecde07411a488eac9115358c73f72d7029874f75803ebead03a41692a900648fb2b2be63b7c8b4e3a71984261185b6d5d6d7201641
-
Filesize
454B
MD55a727bb558fa4e82a85036ead0668ea9
SHA1cda3de5e0d14164833aed08bc02c8a91eeaa3176
SHA256fbc88fb6117c2f21978a6519070ea334d840253dd5376f12d11d1283325204f6
SHA51253f58bc052d9e2a744cdc0a71c2f8bb69515b92c6ead833c0632218ed2fcfde0dc96446bc5dc04960b4405fc77f453c18ca0c54789b12a9c13b9d1182e7b30f6
-
Filesize
8KB
MD598d22fb2035a26a6b9b7decc0c0ff2fa
SHA143a75cf59fc2f8b59b1d962b4e685249eef816d5
SHA256fd5c03fd9ea47c1e820d19bd307ad7c4e53f4b65d288cb675b05cbe76c9b5c25
SHA5123cb7f765d6f4d1dc08a0087086f3fe243bd8ff9e699607cf1e4177892576665c0c799307751cba16fd3f1482e5abb884090024431be2ce86d4080f1d1134d91f
-
Filesize
5KB
MD515eb312db4b3e208b67082653acb8a02
SHA1b0926b1e1733baa3d7f18d3806916f92704fccff
SHA25672347b6d619bc7204a155486e4d09a62a4a494c35a8121349bfe2fecd5af99a8
SHA5127e8d451bc9d1e83615db15d6cdf68230cdd333fa38362979f0408dc80bf680859a2bc3fc09c494805731317b0f136c3227226092f1bcc31c2c80cb73071aa443
-
Filesize
651KB
MD5b181beaba4204ac3ce7bc8e6f0b74312
SHA14ab13763d2ecdf0968f15a39302aab2b1f0ab462
SHA256f36bad234fd1599dd1398d20bc57499314fe96d5de20074536067b2d3c2b4f2d
SHA512d1aaa2fd25e53986c8ea8213a8a02515927c9e9aa3e4d8077a138a29ba32c807ec81473b672a22ffb6ba26126ccd7e1d310e057ef964d3b21b1672a67af5fd7b
-
Filesize
105B
MD527c90d4d9b049f4cd00f32ed1d2e5baf
SHA1338a3ea8f1e929d8916ece9b6e91e697eb562550
SHA256172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb
SHA512d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae
-
Filesize
4KB
MD536400e746829504282eb26b364826aa9
SHA1d39ea9da98be0c331fd71002645f4f40664288a2
SHA256c7ab756437211f6e0e3dcd7482bc67cb910e504345902049eb8abe34a656deb0
SHA5125fe8fae2f5fcbd42c72cc8f6dd70aeec0afd94af5cfd905441630755790dc6ed346823ee009c21537b9cdb3b7b7a39eeed933606726ffd891dae47b60465f640