Overview

overview

10

Static

static

7

a2bfa6c50b...18.exe

windows7-x64

10

a2bfa6c50b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2bfa6c50b24d7f2e9353f7a7bf9a76e_JaffaCakes118

  • Size

    602KB

  • Sample

    240817-qx1zhs1ekq

  • MD5

    a2bfa6c50b24d7f2e9353f7a7bf9a76e

  • SHA1

    2dfb0a5ffcac876d7b4a87864b37f6553df42a4f

  • SHA256

    69ebaf450042f51b89f4f38882265342264f535a42fb80ccce3ba1f1e681ecbe

  • SHA512

    bd4e1d9f4eb01df36f8b1793d1f30296a906f467aff8508ed67ca3a1ccf1f14b6cdf4dcbabde11306ab464a420ec7021e0a85d84e3d4a9f58bf28308fb56e864

  • SSDEEP

    12288:a3TdtLW5WIj1YSSdFxBvBSXyMzBUWb9lx/9AgHLo8OW+rB:0Dsj1dEBBcJ9nPx/igrp+

Score
10/10
ardamaxaspackv2discoveryevasionkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      a2bfa6c50b24d7f2e9353f7a7bf9a76e_JaffaCakes118

    • Size

      602KB

    • MD5

      a2bfa6c50b24d7f2e9353f7a7bf9a76e

    • SHA1

      2dfb0a5ffcac876d7b4a87864b37f6553df42a4f

    • SHA256

      69ebaf450042f51b89f4f38882265342264f535a42fb80ccce3ba1f1e681ecbe

    • SHA512

      bd4e1d9f4eb01df36f8b1793d1f30296a906f467aff8508ed67ca3a1ccf1f14b6cdf4dcbabde11306ab464a420ec7021e0a85d84e3d4a9f58bf28308fb56e864

    • SSDEEP

      12288:a3TdtLW5WIj1YSSdFxBvBSXyMzBUWb9lx/9AgHLo8OW+rB:0Dsj1dEBBcJ9nPx/igrp+

    Score
    10/10
    ardamaxaspackv2discoveryevasionkeyloggerpersistencestealer

    • Ardamax

      A keylogger first seen in 2013.

      keyloggerstealerardamax

    • Ardamax main executable

    • Modifies WinLogon for persistence

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks