Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-09-2024 16:58

General

  • Target

    dca974dd704022af9c3adfdfb42007b0_JaffaCakes118.exe

  • Size

    1.4MB

  • MD5

    dca974dd704022af9c3adfdfb42007b0

  • SHA1

    7b0c9fbcc5ae0fcca3b0a53030819df7c6dfd546

  • SHA256

    c4099ac3f5861b0c6d227c389f5597cffb64dc340a9d79e50eba457745203d8c

  • SHA512

    3a92bd8c403652859177deb60af54f5965ce5d1088a99fc4c72c1c4bcd0857f6a5c3edfbf336be8293442fa5a962670218ce556b0ff03429c1484373b5f21175

  • SSDEEP

    24576:XrHV4SGPDx+SccjcZ3nxQc/aJoSlDZciA0GLlH2DLfbtdhvXijBqBVYq:uSqNkcSQc/aJfl1cbLlWJzvSNqBV/

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.drivehq.com
  • Port:
    21
  • Username:
    dhiliph

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dca974dd704022af9c3adfdfb42007b0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dca974dd704022af9c3adfdfb42007b0_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\system32SQSR.exe
      "C:\Windows\system32SQSR.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2744
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Vodafone Full (Zekty.com).mp3"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2888
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x498
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Vodafone Full (Zekty.com).mp3

    Filesize

    1022KB

    MD5

    caa7d3978e8d9096243fe1f99e11bc52

    SHA1

    a021ab0e865581e0fbfb271472235f3a35342290

    SHA256

    87285bd09d1292eb94e582bb612bbb4a442ed96745424bab1223819ca3255031

    SHA512

    f7bf01bbf9721296c10dd76769398993dd48821b9856aa983cf5b0e5e6658226a09edbfe1f873cd32c13e4ebbe82c74216c29120712f50b6ae967253c8985fc8

  • C:\Windows\system32SQSR.001

    Filesize

    612B

    MD5

    0856b21b923ff4a4164bf970a7614aeb

    SHA1

    ef0b5cbd7ff727757d0ea908a12bc2bc7a67eac1

    SHA256

    220a26314ac62d730ed00487e5e0b9e103e2cf4cd02170706906a912f5461687

    SHA512

    657cb9105e9025e5391498e09289a9c219cb6df13aaa77af7d276bc76397a1cc7926eb51df845b99658a0176f11ac8f8ce9aa542db8fa74714eb131e8c9af3eb

  • C:\Windows\system32SQSR.006

    Filesize

    7KB

    MD5

    87ccf7eb039971590aac6f254b2c788a

    SHA1

    3095496ffd364b32cdbe63ba4dd2f477fd848515

    SHA256

    59973b04dd9bec56a7ff9d898fda25e9214ee7652f2687ba409b435ae07e554b

    SHA512

    d5f9f7855725021522fae819a855d3d2d2cf028b0ea3ac191ad02039cbb688af42b191a1ec4f1868365e2f7de36acca2b7ba3bee0a7b8447820c4521e942d8d2

  • C:\Windows\system32SQSR.009

    Filesize

    75KB

    MD5

    d1fc5eea5c8d9ae874c1cd9a01881e41

    SHA1

    1ee75c9a7e6d49ee87e883156c48d0abab4bdda2

    SHA256

    6e9c368c972caf1060fe0feea653876e5a601fdc48a51dde45cd37befb72f325

    SHA512

    eea8808babf3301b85c14a836bb6bc49f8199946d325060cfb0bfe472f285fb9d4baeeaae7fbd0c4d140806f8664b560e92e417c650af01b80e91b080da940a5

  • C:\Windows\system32SQSR.exe

    Filesize

    471KB

    MD5

    912c55621b4c3f0fb2daef5b4f4f5f4c

    SHA1

    735701c75569b7563950508afc8948b52e7bf4b2

    SHA256

    41ecb7a6e3e9c32ce1bbfdff8fe381f6c21fc1f601f7e9be9fcfa2678d2420a0

    SHA512

    65a08579e959d4beebb5ad026cab451d381e147621be8a0707baca748eaee22050c020e3d54f312376eaf6f20a1fc3713e5e07cc9d4ee7f32b7c17dc15c80d05

  • \Users\Admin\AppData\Local\Temp\@F23B.tmp

    Filesize

    4KB

    MD5

    b7ea0bc4bb833ab77dce179f16039c14

    SHA1

    b05cc205aa6ffc60a5316c1d5d3831def5a60c20

    SHA256

    e7bc62fb964bacd8e3189f22a8d64a27bddeb90007a38da3d3e6b58f6d8a2dba

    SHA512

    5a4ad9b469c7502a930158ca2db814b0b84880b2658a6a6dcca9fee60e6c8dc5f8a3c8d09e280a026d63e3d48b5291074827d16f3e680ce87645d8aad996a652

  • memory/2744-71-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2744-17-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2744-31-0x0000000010000000-0x0000000010006000-memory.dmp

    Filesize

    24KB

  • memory/2888-70-0x000007FEF3400000-0x000007FEF357A000-memory.dmp

    Filesize

    1.5MB

  • memory/2888-64-0x000007FEF56F0000-0x000007FEF5703000-memory.dmp

    Filesize

    76KB

  • memory/2888-40-0x000007FEFB4D0000-0x000007FEFB4ED000-memory.dmp

    Filesize

    116KB

  • memory/2888-41-0x000007FEFB4B0000-0x000007FEFB4C1000-memory.dmp

    Filesize

    68KB

  • memory/2888-34-0x000007FEF7910000-0x000007FEF7BC6000-memory.dmp

    Filesize

    2.7MB

  • memory/2888-39-0x000007FEFB4F0000-0x000007FEFB501000-memory.dmp

    Filesize

    68KB

  • memory/2888-36-0x000007FEFB550000-0x000007FEFB567000-memory.dmp

    Filesize

    92KB

  • memory/2888-35-0x000007FEFB740000-0x000007FEFB758000-memory.dmp

    Filesize

    96KB

  • memory/2888-58-0x000007FEF6D60000-0x000007FEF6D71000-memory.dmp

    Filesize

    68KB

  • memory/2888-59-0x000007FEF6950000-0x000007FEF69A7000-memory.dmp

    Filesize

    348KB

  • memory/2888-62-0x000007FEF57E0000-0x000007FEF57F1000-memory.dmp

    Filesize

    68KB

  • memory/2888-66-0x000007FEF3AB0000-0x000007FEF3B07000-memory.dmp

    Filesize

    348KB

  • memory/2888-69-0x000007FEF3580000-0x000007FEF3592000-memory.dmp

    Filesize

    72KB

  • memory/2888-63-0x000007FEF5710000-0x000007FEF57D5000-memory.dmp

    Filesize

    788KB

  • memory/2888-37-0x000007FEFB530000-0x000007FEFB541000-memory.dmp

    Filesize

    68KB

  • memory/2888-33-0x000007FEFB570000-0x000007FEFB5A4000-memory.dmp

    Filesize

    208KB

  • memory/2888-68-0x000007FEF35A0000-0x000007FEF35B1000-memory.dmp

    Filesize

    68KB

  • memory/2888-67-0x000007FEF3A80000-0x000007FEF3AA8000-memory.dmp

    Filesize

    160KB

  • memory/2888-65-0x000007FEF56D0000-0x000007FEF56E1000-memory.dmp

    Filesize

    68KB

  • memory/2888-38-0x000007FEFB510000-0x000007FEFB527000-memory.dmp

    Filesize

    92KB

  • memory/2888-61-0x000007FEF5800000-0x000007FEF5813000-memory.dmp

    Filesize

    76KB

  • memory/2888-60-0x000007FEF5820000-0x000007FEF584F000-memory.dmp

    Filesize

    188KB

  • memory/2888-42-0x000007FEF5850000-0x000007FEF6900000-memory.dmp

    Filesize

    16.7MB

  • memory/2888-57-0x000007FEF6D80000-0x000007FEF6D98000-memory.dmp

    Filesize

    96KB

  • memory/2888-56-0x000007FEF6DA0000-0x000007FEF6DB1000-memory.dmp

    Filesize

    68KB

  • memory/2888-55-0x000007FEF69B0000-0x000007FEF6A2C000-memory.dmp

    Filesize

    496KB

  • memory/2888-54-0x000007FEF6DC0000-0x000007FEF6E27000-memory.dmp

    Filesize

    412KB

  • memory/2888-53-0x000007FEF6E30000-0x000007FEF6E60000-memory.dmp

    Filesize

    192KB

  • memory/2888-52-0x000007FEF6E60000-0x000007FEF6E78000-memory.dmp

    Filesize

    96KB

  • memory/2888-51-0x000007FEF6E80000-0x000007FEF6E91000-memory.dmp

    Filesize

    68KB

  • memory/2888-50-0x000007FEF6EA0000-0x000007FEF6EBB000-memory.dmp

    Filesize

    108KB

  • memory/2888-49-0x000007FEF6EC0000-0x000007FEF6ED1000-memory.dmp

    Filesize

    68KB

  • memory/2888-48-0x000007FEF6EE0000-0x000007FEF6EF1000-memory.dmp

    Filesize

    68KB

  • memory/2888-47-0x000007FEF6F00000-0x000007FEF6F11000-memory.dmp

    Filesize

    68KB

  • memory/2888-46-0x000007FEF78F0000-0x000007FEF7908000-memory.dmp

    Filesize

    96KB

  • memory/2888-45-0x000007FEFB240000-0x000007FEFB261000-memory.dmp

    Filesize

    132KB

  • memory/2888-44-0x000007FEFB3E0000-0x000007FEFB421000-memory.dmp

    Filesize

    260KB

  • memory/2888-43-0x000007FEF6A30000-0x000007FEF6C3B000-memory.dmp

    Filesize

    2.0MB

  • memory/2888-32-0x000000013FE10000-0x000000013FF08000-memory.dmp

    Filesize

    992KB