Analysis
-
max time kernel
96s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
18-09-2024 19:41
General
-
Target
e9d8be03453f7e607d1d8753e6bd0156_JaffaCakes118.exe
-
Size
732KB
-
MD5
e9d8be03453f7e607d1d8753e6bd0156
-
SHA1
9966f816fd70668dd45fa757fd5c374045fb8c3f
-
SHA256
b8eb0956b3af97e124365de604e5c4e99a1d98f86693a18698efc96ee2a68c23
-
SHA512
ffdd82aa604a3866060ebacb9060b8a870ea504746d92cd588a63b2bac9092caf63f48a33d6a1b3ca25075d92c72259cd31437aafbf7d450a48f0d80b6dcec19
-
SSDEEP
12288:YowqJ3VgL9o1j0szFPtwgTEZJyRj+0jcUE2BacuIM0GXsgJhRsiYv0:viWt0szNtfnpjcUvacubTFRbYv0
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Windows directory 5 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9d8be03453f7e607d1d8753e6bd0156_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9d8be03453f7e607d1d8753e6bd0156_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Xenocode\ApplianceCaches\Install.exe_v204FF5FF\Native\STUBEXE\@WINDIR@\28463\IXRX.exe"C:\Windows\28463\IXRX.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD54b8ed89120fe8ddc31ddba07bc15372b
SHA1181e7ac3d444656f50c1cd02a6832708253428e6
SHA2562ae6b0e14465338be0bc5ad10703f5c823d092ebb8cff7e5a05b7d79c8459b93
SHA51249269b71270b3eda0ddcb399021de9c88f6fd2086cf54fa4898a91e64afe109d44b635d47a5ea9bae7f53a5e968af97fa13bdf699ba00ce879ecadd7bbc8af23
-
Filesize
16KB
MD56630d672286f665ebc76859d22b37151
SHA1987125777aef63e0f570b678226a2133f940a7ec
SHA2569ddcddbdfc907efdcca296230eb1d558459be5bc2ad049febc0240cad9d6959c
SHA5129132ac4d6159dcd25ade05930915d44483b67b22ff306e324bdf3977fce3ed8e567260dc6b47c2d593f0a0bb3593d6f85c1dbd9c28301cee8fcd084007180935
-
Filesize
649KB
MD52bff0c75a04401dada0adfab933e46a7
SHA1364d97f90b137f8e359d998164fb15d474be7bbb
SHA2562aa53bc5da3294817f95d8806effdf28e5af49661a955256c46db2b67cb6e6da
SHA51288b82973d3c042bceb75e12297111fa7b8bd4e2a7a37d26b698c595d8d75ec670cc7aebfa2572206c1b2a4ecbbfa3103affb8bee6d7ef47428a225e2cd1bea3f
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB