Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-09-2024 21:08
General
-
Target
f09de775370cf787b5227e237871af72_JaffaCakes118.exe
-
Size
867KB
-
MD5
f09de775370cf787b5227e237871af72
-
SHA1
763cda7015d4a16bfe8ee522eab102b3fcb7de8c
-
SHA256
a7ff4ec634c66ccea10417e86dfce613e278029b6f11f5ec25f14611561f6b03
-
SHA512
8cef6fadcafb44b4c479e952d58238b5ce4d1d879696757271456fcdd18fddfaaeaaef2878ee829d5338fd2f9c59c0e8e63a2fdf3ce7470687e2f6117bfd81b9
-
SSDEEP
24576:Lc8SjVYKV0omqByAMnuQEf+7p3jletEKDx0B7zM:Lct5dFMnllUt2W
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 37 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f09de775370cf787b5227e237871af72_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f09de775370cf787b5227e237871af72_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\BTKY.exe"C:\Windows\system32\28463\BTKY.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 8403⤵
- Loads dropped DLL
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\BTKY.exe > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\380_love.exe"C:\Users\Admin\AppData\Local\Temp\380_love.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2264 -ip 22641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5d74dae91a831db717e0c3331d790e7d7
SHA1e9541c210eab80dd2d4d971f41133cd84c60045d
SHA256ffab65bd548117dc76b8f85aedf069014224c9b7191a23e956191ab60f4cf413
SHA5126e31eac13a36f5f24001939404f502a189e856c27bee8dbb301bbefa4d2c1540bc6901db59253751d9d875d6d7dc42898b9fe3777fad95aff80aa595c0d170ed
-
Filesize
4KB
MD5f1cf9fcbddeadabb738de497ffefdced
SHA17385a7c87e245da89cc5ef8f9295678c1566f25d
SHA256086083bc73b14286f9c3c29df8b8dc6f014d8b084267fbaeee0af56344d1f779
SHA5123a3b9d279b4c131ef3f358e0163f60ec9e60160a2cc45488adb915fea6642f3df5d35da2ccb6983d790401d237fbc808829f42c42ef958e7a0eac98fc33bb3f6
-
Filesize
457KB
MD5d2366486acd1a1e7512b0024ea3c7bdb
SHA1c9a4948a2902c899fbc8f51755a745b220f26265
SHA2567142651f09fa4a93574850904e21ac8c99dd4e4aff728e2ba68188a459f53461
SHA51250c77906a2175ab488198e2d240d6d8178a189369fc93ff5099e59e1114f8ac1b5496e639d128a60626403b2303a60c51d6f8abae886d90ec2eef03617eeabd5
-
Filesize
386B
MD52b948a1b6c9589b02c2a9a52e24932b4
SHA1155d5840c5724af6ed469b483c5ad2407f79050d
SHA256bf795c23784d0e958cf5205a00c059956f31985a31e212c4bb019f9a9e33c604
SHA512801a990347c48a5a798f18ff5bb682d98894e897e3faac4764bb9fc1dfd11c7be9c3db9b23f9fa3ca16e253af93fe3dd5bb5585429d7f160acc0929d7a2b513b
-
Filesize
8KB
MD531854a50b294dd312eb7fa9eb1c99537
SHA1e0b1682a001e15d0e0e1c1ca732cafb5c80b3160
SHA2562fe2d55aae2deef38a37c9679d74ecf05699d6919760794f69583b43b7fe308c
SHA5120482a4981ba242d4e931bd8b9eb5d606492cffb7609fb69fb349ed19c7a9e36a7e240e5ebe759505d253c5e72fb771612a76419c36fb035987a166569a5111c2
-
Filesize
5KB
MD5603451f504bedb28c3a7bae4c89abf24
SHA1cbfe12186b54663f60663c349739c7a49950c44e
SHA256e4d6577ea390274308877284b6d0cd6672aeb0e76c9c9847ac59c0964f050d13
SHA512136e28e288b3ce26b37c82b078a3440e3232c0f874d7d33e8e6fb6eadfd0024b9009448500c716523b81f142fa3bebf7d11f1dd3e8e6143867b06335eb5f9612
-
Filesize
648KB
MD5ce568bcaf7285124f764aff92f5079d4
SHA1886f698e2239cf615f12b503853a5fa28c53aefc
SHA25659d7d6de8a9e2d5535703d22c36888889530fd011d7f71cf034e93e36e7527af
SHA5129f6e3496930cb5dd9c9403acc865bc94f63f64af49a27ffeedbc9d9082d50bff4a7a772bb98d4a2719f0ecae144393de9cc273ba83ae00abe347b0be0d7c9866
-
Filesize
105B
MD527c90d4d9b049f4cd00f32ed1d2e5baf
SHA1338a3ea8f1e929d8916ece9b6e91e697eb562550
SHA256172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb
SHA512d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB