Analysis

  • max time kernel
    141s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 17:38

General

  • Target

    750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    750d6651064cdb2ab6d741df8d180830

  • SHA1

    ebd8d085f22a8a3e26f58b71c8ccf7831fe3909f

  • SHA256

    a9a7f2894ba0a13b2e10a3f702c3c67eac469636286e56f44e3bf56633c6ef00

  • SHA512

    48a0c95dc843ec38e66dac2a5f12935c6c322e18eb478950601796ede80b357960486d0b5b0c7b201e996d08304857312600965f744f88eb0b97d0019f4b3e83

  • SSDEEP

    24576:FzwTT6FpLU3cd+NcNimJ8nraCtR1YRqNLRF3OiS5NbUxNnL:Fz+TQp436n6nPvYRQ1FfS5VY

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\750d6651064cdb2ab6d741df8d180830_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\SysWOW64\MABWLQ\HHW.exe
      "C:\Windows\system32\MABWLQ\HHW.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2736
    • C:\Users\Admin\AppData\Local\Temp\NeoBot Keygen.exe
      "C:\Users\Admin\AppData\Local\Temp\NeoBot Keygen.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\MABWLQ\HHW.001

    Filesize

    61KB

    MD5

    9681d3e1f2c53ad98b8467b3acca33fc

    SHA1

    04d5d08781f27d6e08ad0262f7325b2be4db7743

    SHA256

    baecddca15ea6932b9cd4e7f5bae848c3c290660a85c408b898150c6f8fd744e

    SHA512

    5c6191fb676ace9d1c2ddfd4e98651959ab24b718ab626c343e2bb271d31edd8ba43ed9de528c7832ddcc2137d2424c22bb19f115dc252e1400cfcd3edce2098

  • C:\Windows\SysWOW64\MABWLQ\HHW.002

    Filesize

    44KB

    MD5

    e65e4bdb2c86226589b88f101153c01b

    SHA1

    731be43621721dba20f0bb74966ea08043ef37fd

    SHA256

    e8a9477bc04824357c0f0bcc1cb665e1dfb6cf5c05f68517749f6cb11821cec2

    SHA512

    7700ee197f109a8f2cff2e529715e371e36c1d9924af0bedef9285f76898d3448847af3bff342813b9bd8ca619b7c39b9607150596008ffc6fe68b338f6769cd

  • C:\Windows\SysWOW64\MABWLQ\HHW.004

    Filesize

    1KB

    MD5

    1ee74b56b1078b1901ba0e1f7e48c920

    SHA1

    99daa6b4d4ee3923ca4e5933d1d56ffa4dc6c4cb

    SHA256

    0251d1442c517493b55a37a43a7baf2f49933949a4a6e5bdeac2b40579cbb82f

    SHA512

    e7ca455035b44e3ab55b99428699b6b323cb796de62e5fc7d8d048d51e8dd9ac9533b40adb251f2d24445b95f249d70c637dbdb94dbb6993c71aa996efb7820a

  • \Users\Admin\AppData\Local\Temp\NeoBot Keygen.exe

    Filesize

    603KB

    MD5

    1f8f1049cc68f42bb076b115f5080e8c

    SHA1

    410f64a187df631980fcdf6103cc09234494b8ad

    SHA256

    fe98ec45f426733e0fabcbb57c4e729a9a2b8e0e5213f6582a8894fb906def18

    SHA512

    6669cd4221eb92bfe9b6e772763f970249976d7b2785fefede0ed94b680abda3039323b5feaa986c2820187b76d88aed2997f034aabd0526be09044849945389

  • \Windows\SysWOW64\MABWLQ\HHW.exe

    Filesize

    1.7MB

    MD5

    9a6a50772539f5a61fefa29c34666223

    SHA1

    b2b8650d817ef7d86bfef48420e9716f0ffdccce

    SHA256

    93db12799d366bbb10f28b923188e3f1457b3ec931ddf33ddeb131a80e46f00b

    SHA512

    eb5f89e6b27981d85dc235edc477a4397d08b9e89d638b0e07301a26ca6e640f12251fdcfe1386df4167a2928bc60959289329531bc7a9e14a232ead22935fed

  • memory/2736-22-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2736-30-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2892-27-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2892-28-0x0000000000400000-0x000000000049D000-memory.dmp

    Filesize

    628KB