Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 17:38
Static task
static1
Behavioral task
behavioral1
Sample
750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
750d6651064cdb2ab6d741df8d180830
-
SHA1
ebd8d085f22a8a3e26f58b71c8ccf7831fe3909f
-
SHA256
a9a7f2894ba0a13b2e10a3f702c3c67eac469636286e56f44e3bf56633c6ef00
-
SHA512
48a0c95dc843ec38e66dac2a5f12935c6c322e18eb478950601796ede80b357960486d0b5b0c7b201e996d08304857312600965f744f88eb0b97d0019f4b3e83
-
SSDEEP
24576:FzwTT6FpLU3cd+NcNimJ8nraCtR1YRqNLRF3OiS5NbUxNnL:Fz+TQp436n6nPvYRQ1FfS5VY
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\MABWLQ\HHW.exe family_ardamax -
Executes dropped EXE 2 IoCs
Processes:
HHW.exeNeoBot Keygen.exepid process 2736 HHW.exe 2892 NeoBot Keygen.exe -
Loads dropped DLL 6 IoCs
Processes:
750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exeHHW.exeNeoBot Keygen.exepid process 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe 2736 HHW.exe 2736 HHW.exe 2892 NeoBot Keygen.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HHW.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HHW Start = "C:\\Windows\\SysWOW64\\MABWLQ\\HHW.exe" HHW.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exeHHW.exedescription ioc process File created C:\Windows\SysWOW64\MABWLQ\HHW.exe 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MABWLQ\ HHW.exe File created C:\Windows\SysWOW64\MABWLQ\HHW.004 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe File created C:\Windows\SysWOW64\MABWLQ\HHW.001 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe File created C:\Windows\SysWOW64\MABWLQ\HHW.002 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exeHHW.exeNeoBot Keygen.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NeoBot Keygen.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
HHW.exepid process 2736 HHW.exe 2736 HHW.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
NeoBot Keygen.exepid process 2892 NeoBot Keygen.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
HHW.exedescription pid process Token: 33 2736 HHW.exe Token: SeIncBasePriorityPrivilege 2736 HHW.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
HHW.exepid process 2736 HHW.exe 2736 HHW.exe 2736 HHW.exe 2736 HHW.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exedescription pid process target process PID 3064 wrote to memory of 2736 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe HHW.exe PID 3064 wrote to memory of 2736 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe HHW.exe PID 3064 wrote to memory of 2736 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe HHW.exe PID 3064 wrote to memory of 2736 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe HHW.exe PID 3064 wrote to memory of 2892 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe NeoBot Keygen.exe PID 3064 wrote to memory of 2892 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe NeoBot Keygen.exe PID 3064 wrote to memory of 2892 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe NeoBot Keygen.exe PID 3064 wrote to memory of 2892 3064 750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe NeoBot Keygen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\MABWLQ\HHW.exe"C:\Windows\system32\MABWLQ\HHW.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\NeoBot Keygen.exe"C:\Users\Admin\AppData\Local\Temp\NeoBot Keygen.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD59681d3e1f2c53ad98b8467b3acca33fc
SHA104d5d08781f27d6e08ad0262f7325b2be4db7743
SHA256baecddca15ea6932b9cd4e7f5bae848c3c290660a85c408b898150c6f8fd744e
SHA5125c6191fb676ace9d1c2ddfd4e98651959ab24b718ab626c343e2bb271d31edd8ba43ed9de528c7832ddcc2137d2424c22bb19f115dc252e1400cfcd3edce2098
-
Filesize
44KB
MD5e65e4bdb2c86226589b88f101153c01b
SHA1731be43621721dba20f0bb74966ea08043ef37fd
SHA256e8a9477bc04824357c0f0bcc1cb665e1dfb6cf5c05f68517749f6cb11821cec2
SHA5127700ee197f109a8f2cff2e529715e371e36c1d9924af0bedef9285f76898d3448847af3bff342813b9bd8ca619b7c39b9607150596008ffc6fe68b338f6769cd
-
Filesize
1KB
MD51ee74b56b1078b1901ba0e1f7e48c920
SHA199daa6b4d4ee3923ca4e5933d1d56ffa4dc6c4cb
SHA2560251d1442c517493b55a37a43a7baf2f49933949a4a6e5bdeac2b40579cbb82f
SHA512e7ca455035b44e3ab55b99428699b6b323cb796de62e5fc7d8d048d51e8dd9ac9533b40adb251f2d24445b95f249d70c637dbdb94dbb6993c71aa996efb7820a
-
Filesize
603KB
MD51f8f1049cc68f42bb076b115f5080e8c
SHA1410f64a187df631980fcdf6103cc09234494b8ad
SHA256fe98ec45f426733e0fabcbb57c4e729a9a2b8e0e5213f6582a8894fb906def18
SHA5126669cd4221eb92bfe9b6e772763f970249976d7b2785fefede0ed94b680abda3039323b5feaa986c2820187b76d88aed2997f034aabd0526be09044849945389
-
Filesize
1.7MB
MD59a6a50772539f5a61fefa29c34666223
SHA1b2b8650d817ef7d86bfef48420e9716f0ffdccce
SHA25693db12799d366bbb10f28b923188e3f1457b3ec931ddf33ddeb131a80e46f00b
SHA512eb5f89e6b27981d85dc235edc477a4397d08b9e89d638b0e07301a26ca6e640f12251fdcfe1386df4167a2928bc60959289329531bc7a9e14a232ead22935fed