Overview

overview

10

Static

static

3

da2ae7a0e2...18.exe

windows7-x64

10

da2ae7a0e2...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    11-09-2024 10:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    da2ae7a0e21b636880262689a2781499_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    da2ae7a0e21b636880262689a2781499

  • SHA1

    36c0c56cd1d1a185b4dfbff21ca4ee65346baf71

  • SHA256

    28ba319bfdaaac8d64bc728aceb4ddbb0c0c5fc35c55557d41d6bbabe2fb5940

  • SHA512

    fcee43a8a959072daf9edb07ba63062953d8e6ec70c7c8aea1a4e047b1818a549d71d8350726b18ee00a441f217a2f5e22c953541dd9d2311266e10afda6fa72

  • SSDEEP

    24576:jzwTT62d6pGJCqiWX12ZamllupwS8GCZAQvGOOirxDVLBOg01wX35p8D6okDqtoG:jz+Ttd6pGxeambuOpGulOlir9OgNXgOT

Score
10/10
ardamaxdiscoverykeyloggerpersistencestealer

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da2ae7a0e21b636880262689a2781499_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\da2ae7a0e21b636880262689a2781499_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\GECNDL\TTC.exe
      "C:\Windows\system32\GECNDL\TTC.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2740
    • C:\Users\Admin\AppData\Local\Temp\notepad.exe
      "C:\Users\Admin\AppData\Local\Temp\notepad.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 MSCOMCTL.OCX /s
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:2840
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 TABCTL32.OCX /s
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2560
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 MSINET.OCX /s
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH\NewErrorPageTemplate[1]
    Filesize

    1KB

    MD5

    cdf81e591d9cbfb47a7f97a2bcdb70b9

    SHA1

    8f12010dfaacdecad77b70a3e781c707cf328496

    SHA256

    204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd

    SHA512

    977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\errorPageStrings[1]
    Filesize

    2KB

    MD5

    e3e4a98353f119b80b323302f26b78fa

    SHA1

    20ee35a370cdd3a8a7d04b506410300fd0a6a864

    SHA256

    9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

    SHA512

    d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\dnserrordiagoff[3]
    Filesize

    1KB

    MD5

    47f581b112d58eda23ea8b2e08cf0ff0

    SHA1

    6ec1df5eaec1439573aef0fb96dabfc953305e5b

    SHA256

    b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928

    SHA512

    187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\httpErrorPagesScripts[1]
    Filesize

    8KB

    MD5

    3f57b781cb3ef114dd0b665151571b7b

    SHA1

    ce6a63f996df3a1cccb81720e21204b825e0238c

    SHA256

    46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

    SHA512

    8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

    Download Submit

  • C:\Windows\SysWOW64\GECNDL\AKV.exe
    Filesize

    485KB

    MD5

    42150775d201a85ebc379d21aa253f85

    SHA1

    fccd7df34e16abaf8d55935016cdb15df8041e06

    SHA256

    00206ccef9ee8da111cc547c698b7e61736b328de48ac5c307d05f2921ef0b9c

    SHA512

    4ff3c587a8d88e319acb028829c75ecb3e11c16a62ba9c2090720613c51c6555af698ba8ff75672b405602f196ed1b99dbeb9395bae62aac2140fa31600b36e0

    Download Submit

  • C:\Windows\SysWOW64\GECNDL\TTC.001
    Filesize

    61KB

    MD5

    9681d3e1f2c53ad98b8467b3acca33fc

    SHA1

    04d5d08781f27d6e08ad0262f7325b2be4db7743

    SHA256

    baecddca15ea6932b9cd4e7f5bae848c3c290660a85c408b898150c6f8fd744e

    SHA512

    5c6191fb676ace9d1c2ddfd4e98651959ab24b718ab626c343e2bb271d31edd8ba43ed9de528c7832ddcc2137d2424c22bb19f115dc252e1400cfcd3edce2098

    Download Submit

  • C:\Windows\SysWOW64\GECNDL\TTC.002
    Filesize

    44KB

    MD5

    e65e4bdb2c86226589b88f101153c01b

    SHA1

    731be43621721dba20f0bb74966ea08043ef37fd

    SHA256

    e8a9477bc04824357c0f0bcc1cb665e1dfb6cf5c05f68517749f6cb11821cec2

    SHA512

    7700ee197f109a8f2cff2e529715e371e36c1d9924af0bedef9285f76898d3448847af3bff342813b9bd8ca619b7c39b9607150596008ffc6fe68b338f6769cd

    Download Submit

  • C:\Windows\SysWOW64\GECNDL\TTC.004
    Filesize

    1KB

    MD5

    0d01cf6bbafe246c04889c30dd4b5fbb

    SHA1

    cf5c25e0acf726c7c71c54f0ca7333530e4f612b

    SHA256

    0f1e6a2598b47c98011dcc0ef4fcb52814342d24ed9cfeaa5df57f606e3a281a

    SHA512

    a0d0ddb41218f314fb289b5b154fccfc864063f147e294136f83a6f619d8b8b262473e74702371e1c859091cf2c5bd553141b46f14d90bfb6f606ca3f8a2f95e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\notepad.exe
    Filesize

    656KB

    MD5

    6a7ddb1d5cf3882a13d8565d67da8c54

    SHA1

    051aa5802be3074204b0c5e7db210c75389b66ea

    SHA256

    78fe3a439605dedcb581c19c9aa4bc31060e9886d22ead41f72365850b51679d

    SHA512

    43ba28f50061122f163c7a5ad143056efe4857bcfbb8c80f94db286fb7a7e1756c53ba8325454375294da1c6cfb3540f86156fec8d3baf389cc0b068e2f68bf2

    Download Submit

  • \Windows\SysWOW64\GECNDL\TTC.exe
    Filesize

    1.7MB

    MD5

    9a6a50772539f5a61fefa29c34666223

    SHA1

    b2b8650d817ef7d86bfef48420e9716f0ffdccce

    SHA256

    93db12799d366bbb10f28b923188e3f1457b3ec931ddf33ddeb131a80e46f00b

    SHA512

    eb5f89e6b27981d85dc235edc477a4397d08b9e89d638b0e07301a26ca6e640f12251fdcfe1386df4167a2928bc60959289329531bc7a9e14a232ead22935fed

    Download Submit

  • memory/2740-17-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2740-106-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2768-27-0x0000000004B50000-0x0000000005BB2000-memory.dmp

    Filesize

    16.4MB

    Download