General
-
Target
dcbd04ef71f4aaace379b096ea0b9fea_JaffaCakes118
-
Size
1.2MB
-
Sample
240912-wcfqqswdkj
-
MD5
dcbd04ef71f4aaace379b096ea0b9fea
-
SHA1
830893bab522314e4f3f1e9ec139b62cee042ff4
-
SHA256
5b7ef1e7fd73127328874afee6471baba153d260fd925e0b628db361f02ec387
-
SHA512
87df19e4e580db8ef189eca234c6ff363f0afa82237e6839ea7f06e6a68556592f9462ab326663b495dbad3410f4d6af2c82a013ec0f9eafc3e4cb422beb6d7f
-
SSDEEP
24576:XuNOTzuHmm4h+C5hDbex7ohZGNtT96EWvmHw5e1OcBTDMDjVqLcdYEGrlZ3FF29r:XucTzq4EC5rGDEEUO+e1OcBUjVqgdvG3
Static task
static1
Behavioral task
behavioral1
Sample
dcbd04ef71f4aaace379b096ea0b9fea_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dcbd04ef71f4aaace379b096ea0b9fea_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
dcbd04ef71f4aaace379b096ea0b9fea_JaffaCakes118
-
Size
1.2MB
-
MD5
dcbd04ef71f4aaace379b096ea0b9fea
-
SHA1
830893bab522314e4f3f1e9ec139b62cee042ff4
-
SHA256
5b7ef1e7fd73127328874afee6471baba153d260fd925e0b628db361f02ec387
-
SHA512
87df19e4e580db8ef189eca234c6ff363f0afa82237e6839ea7f06e6a68556592f9462ab326663b495dbad3410f4d6af2c82a013ec0f9eafc3e4cb422beb6d7f
-
SSDEEP
24576:XuNOTzuHmm4h+C5hDbex7ohZGNtT96EWvmHw5e1OcBTDMDjVqLcdYEGrlZ3FF29r:XucTzq4EC5rGDEEUO+e1OcBUjVqgdvG3
-
Ardamax main executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-