Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/09/2024, 02:13 UTC

General

  • Target

    d7745026d22546598df8bd54872e5594_JaffaCakes118.exe

  • Size

    592KB

  • MD5

    d7745026d22546598df8bd54872e5594

  • SHA1

    1ccc35b82e8176382a4413cd42073ecff73745c3

  • SHA256

    69d02abd3ecf549e8e28cf1a7f0e92918d5515d3363edb0553226b6db766ff9b

  • SHA512

    bf4724eab04faa0f4109735d5763a23a77285e09050837a1743b43311d9fca94335647f94fa877838a5b81350c1741047ab0ad06eeabb9d80de3bff2c9f9a61b

  • SSDEEP

    12288:qURUFJbpVqj8FiJ1f3Px4uNK7MsOfPrCnEq7fZbmV2cB1QHFSr2X:Wdqj8F+1f3PSuwMsOfzBq2fss2X

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7745026d22546598df8bd54872e5594_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d7745026d22546598df8bd54872e5594_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\28463\MTFE.exe
      "C:\Windows\system32\28463\MTFE.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2176
    • C:\Users\Admin\AppData\Local\Temp\edxSilkroadLoader_Lite.exe
      "C:\Users\Admin\AppData\Local\Temp\edxSilkroadLoader_Lite.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\edxLabs\edxSilkroadLoader\edxSilkroadLoader.ini

    Filesize

    161B

    MD5

    a38d949cbc46ded2a22539c59c68e36a

    SHA1

    fd164771831e74b519903ca110712a7c65ca2fb6

    SHA256

    1548b9b55eb1c0f4e1241ff27a3c1ec49487244586a437be54a7ca7ebd1e3f50

    SHA512

    370fad724e1a5fc8944f4059440dc609d09e12d77ba3f9268a4e89e7dc6bfdcd47faa211492fa2fd2f8e131ea316f269f7cc3cad50276e5dda601649ad5463e6

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    395KB

    MD5

    b8fa30233794772b8b76b4b1d91c7321

    SHA1

    0cf9561be2528944285e536f41d502be24c3aa87

    SHA256

    14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a

    SHA512

    10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d

  • C:\Windows\SysWOW64\28463\MTFE.001

    Filesize

    388B

    MD5

    aefa2a5f53916cc294c0200f4963cb2a

    SHA1

    50a2e1638fc1cd91ade4d9136ea22fdf01be04d3

    SHA256

    c4d89bcc2f1e2b385dc5b413a045a103720da4f110bbe07977654f6903c80a84

    SHA512

    9cb4bf71e5918452c7a7a083741aa05b409acf4820f23fa4fd53cefc99c1b28294aa6b9d58383c16e30fb166839dcbbb74cfdef7cea90f5e62fd3caa76809571

  • C:\Windows\SysWOW64\28463\MTFE.006

    Filesize

    8KB

    MD5

    43f02e9974b1477c1e6388882f233db0

    SHA1

    f3e27b231193f8d5b2e1b09d05ae3a62795cf339

    SHA256

    3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba

    SHA512

    e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f

  • C:\Windows\SysWOW64\28463\MTFE.007

    Filesize

    5KB

    MD5

    b5a87d630436f958c6e1d82d15f98f96

    SHA1

    d3ff5e92198d4df0f98a918071aca53550bf1cff

    SHA256

    a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2

    SHA512

    fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce

  • \Users\Admin\AppData\Local\Temp\@9C20.tmp

    Filesize

    4KB

    MD5

    c3679c3ff636d1a6b8c65323540da371

    SHA1

    d184758721a426467b687bec2a4acc80fe44c6f8

    SHA256

    d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb

    SHA512

    494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7

  • \Users\Admin\AppData\Local\Temp\edxSilkroadLoader_Lite.exe

    Filesize

    211KB

    MD5

    85b550da7a1131fcf74b0254411476f9

    SHA1

    f58d4736ac43485a4aa3e81d2bd43b352221e959

    SHA256

    9465dc4158d175bb3e16ce2c6649b1dd8c56857197fd8ac34f7a0f6020429e10

    SHA512

    fafed8fb9beb44316af748bb582af419166e61d26eb5fb736655b3ffbadc812ede2043edee2362d027f51126f1de8c6d099c0843f75b2a4102d7bb60b04371d4

  • \Windows\SysWOW64\28463\MTFE.exe

    Filesize

    473KB

    MD5

    17535dddecf8cb1efdba1f1952126547

    SHA1

    a862a9a3eb6c201751be1038537522a5281ea6cb

    SHA256

    1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd

    SHA512

    b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8

  • memory/2176-46-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.