Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-08-2024 23:54
General
-
Target
bfb15bb6d83aae45602945097c96e901_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
bfb15bb6d83aae45602945097c96e901
-
SHA1
753a4994302b7d7f6ed908ebbaf872c036d50f92
-
SHA256
ea15114bf7a597c69f61fbe6c6677e1b1d0adc01f3340ece18b0c2fc981845a4
-
SHA512
ed8eab7ebb96fd3c1265c4be40d2e5fb9394740e060572a51bacaa3e0949812ee483b9fe970274602146c2a9d0ed7f1ffc7368f1141ec0774932948fd2da59a7
-
SSDEEP
24576:MHvZT6pIATHLBxh0JYxAxov8JAeAywXMlErdGy3R8a3vaAnYlyf:UBT6pI0H1mYxA0ywX5rf5x7
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfb15bb6d83aae45602945097c96e901_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bfb15bb6d83aae45602945097c96e901_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ESETPI\KOU.exe"C:\Windows\system32\ESETPI\KOU.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\ESETPI\KOU.exe > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\NNN Turbo Injector V3.0.exe"C:\Users\Admin\AppData\Local\Temp\NNN Turbo Injector V3.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
657KB
MD5c06a2ced5dbdeb0d716fb20b834c5879
SHA199a0ba3ae771bb247e17bd2a56f66b2b2c45fe81
SHA256b26512b8168dede558f3117ea041995f06c39ff1ea658aeb6453dcbb48b7e675
SHA51297ed06e53edfeb449bcccdc0cd6ff07c2350881e74d86b513a6e7c4ccabb5a4f6c3385e650181cc816b690daa0988cf525caa4343eb70561a10ba25b430f378f
-
Filesize
461KB
MD5eed8ebfafcd3dcb0f88b237388fba8df
SHA1620767d6de979bf360e3a188ed03534c769f337b
SHA256dc3c5152d69547ffb583574707025eee74af46882cdf851221f66b1e81d2ed90
SHA51228148a2bfdbcaf61f5f664c6b4dd0377d151d775ad001818da2bba6327f02020fabb016a4c8aaa5f841ea1dc1a6d8419bca55bc74924a657476e15abbd8dabb3
-
Filesize
61KB
MD534c92b717ae97bc926f56ba56a44f24a
SHA1ccaf3c6bf0c73564d0bf19c92b8d25008ffffbfa
SHA2566e60d85b35f5e9222375f606e4116b38364a4a943596ddb0d914cf1cf4791774
SHA5122a9eb63837db128c9e036976d903ebd925e6952ab6bf4efa0e370e79f9fefe0ed6e44e4ab444f56ace1149f4dd14797f568e8827e7cebd1e5581dcf309f9745a
-
Filesize
43KB
MD5246761f047f6aa98d6eaad66a2f883b9
SHA142474a5b23d03e094103b62fd7e820457cf807c4
SHA2563774021a3cdf32d23fd5921cea4de8c26b08f0d601f3097550a7e8af7b00f111
SHA512d39d0913975ca2f8d585b72667d76de09ce7817f6de26ef21a8b62edc25d7fab39785f036992d19ca5700f5fc2ee377e696142c41529f23f503e8eefff393144
-
Filesize
68KB
MD59f8cfef5ec715a3a2c278926683ae8c7
SHA1b575d77c1cd840ecc5ace3720e0253999826cb43
SHA2567fb748ba7393ac637a7bfd6bfe42e7246112ee4f80b14a3640a12f3a530270ac
SHA512664da9b5fc7a716d4c5ff6cb790a2f0f6002d193c13f32460647e2e6ddefb0f45dc3731ae1af4164eb0d3089b0c2f69eb74e07fd4fead30458087c06f9a09d26
-
Filesize
1KB
MD52c165957af665d2ccadf933f0840c592
SHA1eb2afd51601b4fa028d3aa33d453bd5075893686
SHA256888ea727d43bd243075bbcc0c77e0f4c0cc32c4aef24afdb310a72ee346933b9
SHA51277c6eba430fa8dbc6eac4893c16d4318bfd4487b68e91ef1d8402cc054d00206310e50cf0f6637cd9104bcd6d33a52b70f5db7dba64e1c680713e84bb496752e
-
Filesize
20KB
MD5164ea98e2f64635f8a097870781da36c
SHA17cd9294657902f6bc199007e30f6514fce66f666
SHA256c69e694d6db9a958a99901afb86a8b864a17b510a5dcdd1c176f53abf0c61a61
SHA5124e19842a0d959876cdac60fd145fa36f2d98650b843c6faea2b01e205b2f0ce262b45c1c60fbf483320f012d4c00b96dff36e72d27ecbe9133f09d6618cbde20
-
Filesize
1.5MB
MD59ab9b7b74790b7bb2798dd2b26f4a913
SHA1e8ffa981a0149aa6441dcb0dd42f7baf6eb773a2
SHA256df1c8d608ebd300889cf21c3bda6d5dd2574d68e1f530cc5a885449a22177a75
SHA512ffffe21d8cc244aacaaba2eb13cc77ad800a196ecf6f77637a8a1f6d456cabb8331970ab358ab21dcf9832343379b4f0486da3990d45eb2f2765e55b7404739e
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
680KB
-
Filesize
680KB