a6c9308ae859527f589b101de49a9b86c1ef4db2d3ef341474e6c4a1c9ad7fe6

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ArdamaxKeylogger/ArdamaxKeylogger/Ardamax Keylogger/IWM.chm
Size

33KB
MD5

67fd8e4e2a9fa895a52e557123dfddd9
SHA1

f47cd5ac70a620654af79911e85e5aa158ffbf41
SHA256

6a8c2a8901326b3106ad806393a45b5e1fd6616c133ac503457b4a44a4bf82fa
SHA512

764f01b5385bebfd666d62e10895bda8479eddfce264a63ef85322ad069877947356c3d2de6518f7ff00db96fb1b38273432ab04bd59b37fb89cbe25e9fd77f1
SSDEEP

768:n3fscCfTSjb0O+TJPHjnKFZi4LHnX1OgG8p4/HWkWplk:n3fscCfTcg1eXJjw8pKnUk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1540	hh.exe
1540	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\ArdamaxKeylogger\ArdamaxKeylogger\Ardamax Keylogger\IWM.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads