General
-
Target
7b9a5d170542a9363bb737bab01d8dbb_JaffaCakes118
-
Size
678KB
-
Sample
240731-hh2y9s1glr
-
MD5
7b9a5d170542a9363bb737bab01d8dbb
-
SHA1
7fa201ce107b2bd7b2b72e584810525597a23bd8
-
SHA256
e7cd4a5e4259512047ccd3e38e8c84d574e4aef48043f2d760de3991f6d5b4f7
-
SHA512
bc71a043530c77c3298b328ead34948da4990cf7775963e933c621280e9bd8f7f85283f2fccfebc32b953a800d3809c0793318903a42213ea029a4255b9d7e00
-
SSDEEP
12288:X3TdtLW5WIj1YSSdFxmL6QCXx3eBSXyMzBUWb9lx/9AgHLo8OW+rBj:nDsj1dE95eBcJ9nPx/igrp+1
Static task
static1
Behavioral task
behavioral1
Sample
7b9a5d170542a9363bb737bab01d8dbb_JaffaCakes118.exe
Resource
win7-20240729-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
7b9a5d170542a9363bb737bab01d8dbb_JaffaCakes118
-
Size
678KB
-
MD5
7b9a5d170542a9363bb737bab01d8dbb
-
SHA1
7fa201ce107b2bd7b2b72e584810525597a23bd8
-
SHA256
e7cd4a5e4259512047ccd3e38e8c84d574e4aef48043f2d760de3991f6d5b4f7
-
SHA512
bc71a043530c77c3298b328ead34948da4990cf7775963e933c621280e9bd8f7f85283f2fccfebc32b953a800d3809c0793318903a42213ea029a4255b9d7e00
-
SSDEEP
12288:X3TdtLW5WIj1YSSdFxmL6QCXx3eBSXyMzBUWb9lx/9AgHLo8OW+rBj:nDsj1dE95eBcJ9nPx/igrp+1
-
Ardamax main executable
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
4