Analysis
-
max time kernel
132s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 19:57
Static task
static1
Behavioral task
behavioral1
Sample
757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe
-
Size
512KB
-
MD5
757f1b9fc6bd9bbc6580f914d5aa2522
-
SHA1
2cdc2f2162d15de902d48db9923c54099c818ec8
-
SHA256
87023f898385c88304645e2b44eb82d0b9983b6a3bede25a4d9fe9d27a3275d4
-
SHA512
896561722d48e04cd376e449ab4460aaa84387e497d92e768da12cc0772525e248e8f8ce2bc026735b6c78fc4f799c39f3d88bd3e54767771ac39ac68cda9c75
-
SSDEEP
12288:tuRyiQtCTn1Q81mDhcM72doMggOkCs7t1N8m82CbRU6W9sD:uyiECTn1QfNjygtkKRlU6W9I
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\28463\STPW.exe family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
STPW.exeTASKMAN.EXEpid process 4560 STPW.exe 3352 TASKMAN.EXE -
Loads dropped DLL 4 IoCs
Processes:
757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exeSTPW.exepid process 1984 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe 4560 STPW.exe 4560 STPW.exe 4560 STPW.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
STPW.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\STPW Agent = "C:\\Windows\\SysWOW64\\28463\\STPW.exe" STPW.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exeSTPW.exedescription ioc process File created C:\Windows\SysWOW64\28463\STPW.001 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\STPW.006 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\STPW.007 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\STPW.exe 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AKV.exe 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 STPW.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exeSTPW.exeTASKMAN.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKMAN.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
STPW.exedescription pid process Token: 33 4560 STPW.exe Token: SeIncBasePriorityPrivilege 4560 STPW.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
STPW.exepid process 4560 STPW.exe 4560 STPW.exe 4560 STPW.exe 4560 STPW.exe 4560 STPW.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exedescription pid process target process PID 1984 wrote to memory of 4560 1984 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe STPW.exe PID 1984 wrote to memory of 4560 1984 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe STPW.exe PID 1984 wrote to memory of 4560 1984 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe STPW.exe PID 1984 wrote to memory of 3352 1984 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe TASKMAN.EXE PID 1984 wrote to memory of 3352 1984 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe TASKMAN.EXE PID 1984 wrote to memory of 3352 1984 757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe TASKMAN.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\757f1b9fc6bd9bbc6580f914d5aa2522_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\28463\STPW.exe"C:\Windows\system32\28463\STPW.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\TASKMAN.EXE"C:\Users\Admin\AppData\Local\Temp\TASKMAN.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
15KB
MD52517b5da22104857c8266df762d60139
SHA19540a136e82b6aa5ccf9e4e92a6f7ad995b49e91
SHA2563f194224ddcdb4e93768bb6c0d616330d061ce0dcbe30f18b6f7651555f4600b
SHA512cda08bfc745e317d859e443cfb96ed4a7f773123f5ea99fe2f692676a0d632a4881b4f0defe7f1cfda7a89da4d16cda09107edbc18d57bdc919a55e02acd9e0a
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
524B
MD5093f233d48b68c63495f99523a80f083
SHA183cd4b470372c6a86a6aa332e521c812f6c49802
SHA256f0d283f211e4a8696928755ab67493f5f3f9274fa1bbbef4408c4ca9eba3cf10
SHA5125337ed9a498467fd7b6af9a49906da08138a83c6239af4fc543acf88f2a2a8704b9a920ea20030368568cacf9dc78d982bd42f0411801d17431a37b48deab6bd
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8