Analysis
-
max time kernel
139s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-08-2024 20:52
General
-
Target
9fe4298d4f2f3dde1e801ebfee8cdbe9_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
9fe4298d4f2f3dde1e801ebfee8cdbe9
-
SHA1
60c5db32af08bf06e8fbdc4bef7942943b8461a6
-
SHA256
1350432206bc72e45e26a68642db62d139c901b8ec8a5fbf1231a9d86ef26e3c
-
SHA512
bf731ff130975e0581439bf45faa9fe7e4670629defd0ffdf7e097ba7bb7ce605f03f3798ef2906e935dfb6d2f6e178ad6c387a1e8141ab8751d5842b5c629c9
-
SSDEEP
24576:UHvZTCpS+IGHJ0XMj/cMk9aDr3aL0tZGeRiU/n0yxlib6wHg7:cBTE/tE99aDeL0tZBbdxYew
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fe4298d4f2f3dde1e801ebfee8cdbe9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9fe4298d4f2f3dde1e801ebfee8cdbe9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\JURXYN\KBQ.exe"C:\Windows\system32\JURXYN\KBQ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
459KB
MD528f68e988bfb6a7c9d45d23058cf74e5
SHA1a0740aea5602429f844cc7ba35c637d26c59edf9
SHA2561dd66d2320104e426a9d8ae390d3199a6ae2ecadb85e35eed9c6ed7a1819d478
SHA512dccc2cb961f86a0e11a27976d9f53043df895edf8ca624ace1be2b002b5ce2c372a833b87fdbeb518ada7666c72d01b9724f5ba203b301af444e1ac01104fcda
-
Filesize
61KB
MD5a2e848c23f0e2cca1974ea55e6a99779
SHA134a5a236c6bdfb6b9a47d5cd213147da7a507ad9
SHA256e852249a3fc489ee5c3fb4928dab911c4d826ef180f27faaa2f37a7179d231e4
SHA51270b67fd7368b0efdcaaad3cf8478b7519761afcb0578bded88f61bc357cbddf0c851e8248cab32c1d3b12dc933a33ccd23906aee695a9a9748a1d465566a108f
-
Filesize
43KB
MD594aba5bdc0756bc2ceb5f521c4b620c6
SHA1fbfd46ae5704c7dd6d63b959c1edb869f7dd19cf
SHA2565bc8115fdcbe153a33a3feb65bc9eefe4e2a0357a145525f05689054939779e3
SHA5120f4e154a0813f39f76acc95ec70b87241017d4210b44395bea9ef66c31f0da05503cf8ad665e03fd0c7aed8084e99bf3358de699bbcae2ffbe5176987640e33b
-
Filesize
1KB
MD57a8ee75a8b63f00dec02864d9f872979
SHA154de27f213ad7266f0412fc27c706fd7edc3d520
SHA256c934c2e9434784f35524ba0fef1f422a925cf29253bb93f6da97739b2d9cbbad
SHA512e047a2ab923505dda4da3edf319cfd870527ce7e4ca8e4f46396fa6ca6e614cae80c3da52de3c479720ab0cc4c2c88e6546b85f32d18be507c7ac5b52724541b
-
Filesize
1.5MB
MD5b2d5e28fcce82e8ee5e1c0b1502e8730
SHA12573726de59c9c342e3d77bf7436704e74ad90f4
SHA256b69590e97e053d49295aa1776526052caf3669579e81302825c954b0a4804095
SHA5120318b6cc12c373a200fdfd144af551c90e2db0219115c6d7d3ec43275f177831c71a06a1c9741cc9522defb293212375707df73e28824d4b37c1d8a6d7c0638b
-
Filesize
4KB
-
Filesize
4KB