Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19-08-2024 18:23
General
-
Target
ac147a8e19565297726ec203023de2f3_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
ac147a8e19565297726ec203023de2f3
-
SHA1
9472ef5fb2085ec626cf2bfdb87b513c43cec9f1
-
SHA256
1a14552d5f54ee921bde1ada59b19b9168bae5352ba0ab18a05b3b0883f0c881
-
SHA512
367e7dbf32ac1f9f31f7f2264f60f6fbbb08b0511738e69c4762e1e235e047194ee7ae72e05c25dcdb9b666480b58df91a2844c3f3431adc580240e71c4109f9
-
SSDEEP
49152:N8r5x/XREgpueaHS9m2FcpeIAPbG05UtroxEGh:CHZEgMDy9tXGiUCxEw
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 12 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac147a8e19565297726ec203023de2f3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac147a8e19565297726ec203023de2f3_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Sys\scvhost.exe"C:\Windows\system32\Sys\scvhost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\InstallSB.exe"C:\Users\Admin\AppData\Local\Temp\InstallSB.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
528B
MD519954b87f688197dd07d93f1937d42ac
SHA1b2c44d64a1f0e9cdea3741ecc721e7172808d67f
SHA256da90ce36785bd9b2e09b7a755383cdc65bac1506c4275f665342e4a4b1bad44b
SHA5129eb405b0ec1584cce051cedda8186808c52a2f5a4b9add02be5528e7b0a99960bd793a92a6f4617d085beacf571b49b0b13104359678846e511e293e480c9641
-
Filesize
3KB
MD5833508545fefafa0f8429bba83a6ed7a
SHA13aadd01740d6a2f8c32d9096f3e500f908886ca5
SHA256cdaf148c3a52daf0e937b4757b275ea14c9982a49efaa311d724c35344f02e1b
SHA512ae9188e24c20d3ab4d50290fb76d91ea9dd9121c478d322a9c56f4e5093652d5a53a2df640fb245c4e4f57faacf078a8168b2e580e7f481bb944d40075ad88c5
-
Filesize
5KB
MD5ff2bc313174a6ccfe1e0b5b1a58f0f49
SHA14e983cdee788faf6a13a9d5bf3f00f4a17dd6e8e
SHA256f212c83897599d81f4010f1ef3a43e5709e874912072d38d26a5ef5644462318
SHA512418083066ba5505267f4de91c9e439674e02645c430360dae22dfc390c33b4e0c01857634d1dcb5dc298c296a5f4130397388bceee2ad82ba0a711ab56d1bd0f
-
Filesize
4KB
MD550c8c542dca77df82f5925b145567611
SHA164bdce386146e3548d3d85cf16fdd0d34cbafe2f
SHA2560692f76ec589e517f0a5205e658ca44656322c0382cee2af53890324818b3e0f
SHA512f7df5e9ac0c81f832e8dfe882eb1c4746f30131bef5a56947634146c813df079acd57b3fc954254684c6f4ef291802cd9629e6af3ced9be1f381fdd858a327c2
-
Filesize
4KB
MD5a9680f653434b4766fdc2a3c592af879
SHA1fd8e999c43fa83df3144aa5bbaae73bac3834296
SHA25630e084f531980a35b79dd36ac9ee0022d0aba792da99b3d71eea26d327db9ad3
SHA512685fe7bbaf9fe5d140f07e9fe0f1eff0cecf8a3a4d050fe917ce8eddac3394ab7b8cea575e2d6f3dace309716662fbb5a9016850b120ea2099a00cfc848f57ac
-
Filesize
2.0MB
MD564c607101b706d00a0ab260e6c36f691
SHA18c29a2dc76abf3e696dce25ab80b9a66ffcd1f04
SHA2560b86f575d17f48060bb1ae5c035ff7e467d142532e70397222a3380b5ce9f20e
SHA512e61acd10a0719f698fa22ce0bd3332c7ee127c79a4b935658f756ed0fb2d2cb6234591b363da162b003dfae5a257eade1437a912f1e1b1212e863a4a0ff80d03
-
Filesize
1.8MB
MD57b785cdaee7e096c79b44e24fe1818cb
SHA1c4f8b3648dff3c722ee90c40976234595b508a23
SHA256006dfb626cff00c51e89e82dbe074c573dc9a5131eb44e715043eb687a22426c
SHA51255e9c3adff0373db27158d08f7699b236db3c6e4c3c5defac942eb6358a5e82340b1e778be2e9a7a21c952739a755b3076c5769bcc930b039234d725db44bfd9
-
Filesize
459KB
MD54db1b69341dc88b901d85be34278a634
SHA10d55d2852a58b597c96c1dcec25efc961d882ba1
SHA256c3f29e3f8b9eb7c20a0046fc105d2199dc5327a570e8c76908e44be1200fb893
SHA512e11ee43c65179a562254cc63fda5c25ae228603bd88fd357faea2a5b49b4df11dfde5efe46544ac138d008cdffc419c793b35781ef201a9462a9eda30b52dee0
-
Filesize
168KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
168KB