Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
04-10-2024 01:39
General
-
Target
114dbac4d859d2c41dc8cba3cbd76ddf_JaffaCakes118.exe
-
Size
803KB
-
MD5
114dbac4d859d2c41dc8cba3cbd76ddf
-
SHA1
9f42c486c6863fe5f2c413aad16dad63440ddb94
-
SHA256
ce35f32b6d80fa322b20cfebf4cb9b65b8701eb31c9726fa37221c3995616d41
-
SHA512
b23b6faf1b6b75d05677e1c1b150306662124f894c55345268b0e872edd3699fc6e67be223898d17c063d170f2c4da9607e838e29dc05b19e5aa7e7260e2e0ec
-
SSDEEP
12288:w3TdtLW5WIj1YSSdFxsBSXyMzBUWb9lx/9AgHLo8OW+rB:qDsj1dEcBcJ9nPx/igrp+
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\114dbac4d859d2c41dc8cba3cbd76ddf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\114dbac4d859d2c41dc8cba3cbd76ddf_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\svchost.exeC:\Windows\system32\28463\svchost.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c427f41a9eb12166c278da8fed8a0c4a
SHA1e0e1d1c8f6b58675a544f1461997cfc37a2e6c63
SHA256ee74d1ba7e74e916f57ac4134aa5aa6eb7f920e7dae3b4cdb75af9225da616c6
SHA512ea2e49983e04afaa0eec5b28eeed1e9c804326b49933e69962805c10a405cb7dd87061e50355f395e74107cb6ca674d4c8c0000ef13505ec58b1d7dec873aa85
-
Filesize
513KB
MD50c7a714b8e1d2ead2afc90dcc43bbe18
SHA166736613f22771f5da5606ed8c80b572b3f5c103
SHA256800bdf00e09f302a17e22d26dffbea037e3c077ef9f6d1d585c114f079397a9e
SHA51235db0de86c168eb6302dcbaa1e1f9ec96b5a8814e7067e1a7bb682e9f35fc06c51148a08e6f7df1e8caeb2effde555c53966a8922e8fef6b7ce194dc81c984b4
-
Filesize
2B
MD5e0aa021e21dddbd6d8cecec71e9cf564
SHA19ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA256565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
SHA512900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
-
Filesize
96B
MD59ece103c47335f0cc777f1132b8d522f
SHA163afa171c64f86d99db81723e1335e960e85fa43
SHA25669815d4932ddde240ce6b1353305d2fab58ca402e9c478452c8e37ce8a7b2ac9
SHA512b1ac64c71c6338bf0ab33df938128822da680f20d0552edb2edb808f1c75bafb88467412fc8dc60ed8022a1f0c4f3fcbecb69a320ec871b3a766482f32d6eb05
-
Filesize
803KB
MD5114dbac4d859d2c41dc8cba3cbd76ddf
SHA19f42c486c6863fe5f2c413aad16dad63440ddb94
SHA256ce35f32b6d80fa322b20cfebf4cb9b65b8701eb31c9726fa37221c3995616d41
SHA512b23b6faf1b6b75d05677e1c1b150306662124f894c55345268b0e872edd3699fc6e67be223898d17c063d170f2c4da9607e838e29dc05b19e5aa7e7260e2e0ec
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
4KB
-
Filesize
4KB