Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
03-10-2024 22:59
General
-
Target
10d45979874eb4499795d8a1e51f2836_JaffaCakes118.exe
-
Size
2.3MB
-
MD5
10d45979874eb4499795d8a1e51f2836
-
SHA1
ed0a03845121cb397433226b5ef218b9291f8ea7
-
SHA256
02d47750c5216e8511202b46db7fd20dfff9c81b6cd15ceef93ee301702cd3f2
-
SHA512
de3809c38484ffab72fd3bbab0b1c5e5223e16ccd9da52c300cf3e1b37842a6845cba6137f7938138e477eddc696d156b47a679215b439b34c20fd04fe73b1bc
-
SSDEEP
49152:sygCp6HtAtYNox4cdbTPieMm9aJAesm5eYfUBrwAqANA+IUSGLE26Jd:s/Cp6HtAtSof79KAesmkSerqAKFGo
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d45979874eb4499795d8a1e51f2836_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\10d45979874eb4499795d8a1e51f2836_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32QPSS.exe"C:\Windows\system32QPSS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SYSTEM~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\ghn_0001.wmv"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD58273c4435bd0bd5d1c5dd6e1094e4a64
SHA15556e60360bc2311ae8e1f3b3742a3be74076c99
SHA25668b7b3d76f05e996f4c645a69dda8233114e7366b9a324f7d8a3e01f634a92d1
SHA5122f8d49cbb11d9692d8b2b2f5dc80b051e6d938fe4b8f287447572df4a73acada834f464aae0169033862c0ee703e058d2f9c30db4f5ddfb99fc29f63f7810e27
-
Filesize
404B
MD5466dac75e7a23d24d2a284f59d72cec5
SHA17e3541a7688937d4a67691a1e8d7470ba79fc998
SHA2568a880ed186650af7c01d18cfbed4ce7af88c2a2ecef8ec221526dbe85fcbca14
SHA512eb7613536b565a2bcbf2702e83f0b06d398c5dfbbde915969716424719193710ae2e8088130a98d43c2104e74458e5f714a648c586208603a80d9ac0def857d2
-
Filesize
7KB
MD59bff554f06d83650594d29c02ff22490
SHA15b00b436753479c29403b18256d1be009134f920
SHA25637dc6bab558f611dface5ee2d0cb73f078f1b850de80f4bc5c1e4ebde024c693
SHA512eb98be1e1b86acbe8d36542a42ec73f2357392ece2bca103910be6f5c06b5fbb3b8639cf4b8da03ccf284f09dffece1b12e2882f6f13c5d17ca66a8560e7e572
-
Filesize
5KB
MD5b6f12dd5978a40f15490b637523b0207
SHA1c2a9ae1415e61f59ceaffe91bb5ccde499bcfafd
SHA256097124b7451b236ec652f964aeb3a06a8caf8aa8763db37cc1db16ab91dffe9e
SHA5125baa4a7641cbdd5e6a331f1a5d753ae3d5a2b8e64a6db21ac475176b0d020e6cc79c5ef83fb35003612976d39fcabc3786e46a1b36ca6f91a614995e50c37795
-
Filesize
471KB
MD59db739b6cc6f87cc09aa60428f94551a
SHA1f8dad673918a9f342a90d8c0221423c90ae35fd7
SHA256050dbbfa127d4db9f3fdf7efc1961dc2530a5affd1921818c053d7aaa07f1eda
SHA5120f410d81d92dbeec6bbc17a3f6e296bc8e96544b45e7ca2209d832bcdce1b3993c43c1f1298d77bb03eff94bb0c27a7cb950d599a6572a2e4c929400edde5a2d
-
Filesize
4KB
MD5d1e6a3b3fec7d6f1d0db1bc02da26d93
SHA1d7da87bdc09c38836cecd0844bfd587172c076f4
SHA256bca04b3b3b4b8b416597ecd653056ec98f88e16a57ef64f2143b09ab892a3730
SHA512327def77c38f293c4e8b4f20a3380bc7c5ba5b72f2431b20f67cbaeb2a4d11c2dd9493e477d36de88d75cf185b8fc2936fd6eee3cfa9bcd5620e0fc054f232f8
-
Filesize
348KB
-
Filesize
16.7MB
-
Filesize
2.7MB
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
68KB
-
Filesize
412KB
-
Filesize
116KB
-
Filesize
2.7MB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
144KB
-
Filesize
160KB
-
Filesize
1.5MB
-
Filesize
68KB
-
Filesize
188KB
-
Filesize
64KB
-
Filesize
92KB
-
Filesize
2.0MB
-
Filesize
308KB
-
Filesize
264KB
-
Filesize
72KB
-
Filesize
1.4MB
-
Filesize
496KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
348KB
-
Filesize
192KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
132KB
-
Filesize
260KB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
312KB
-
Filesize
348KB
-
Filesize
84KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
464KB
-
Filesize
284KB
-
Filesize
388KB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
24KB