Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
05-10-2024 05:43
General
-
Target
1663c91a5ac2dc1621dff7b70f923458_JaffaCakes118.exe
-
Size
922KB
-
MD5
1663c91a5ac2dc1621dff7b70f923458
-
SHA1
fa25086f5c71b2f7d84c2b3c1a79349915425de5
-
SHA256
82f9c12f77368b7013e7a19818e3053e30eb9aa25469940823152214de8eaa56
-
SHA512
480c2f442ee15fa343813619e152b51e22cbc7aa90ab7224f39511d012fb5570bdf54b9e5bd69988c93627fddd97bc4ed5d2e434433fe74b0cab48e0bce68815
-
SSDEEP
24576:43xZPCUOAhkpBZKKjp5cslpHsIm0lx1UjSQ/m:o5OAKd11ftmVj6
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 10 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1663c91a5ac2dc1621dff7b70f923458_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1663c91a5ac2dc1621dff7b70f923458_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\acnner tools\20.1.11.06\2012.05.13T21.26\Virtual\STUBEXE\@APPDATALOCAL@\Temp\pruebaconfoto27.exe"C:\Users\Admin\AppData\Local\Temp\pruebaconfoto27.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\acnner tools\20.1.11.06\2012.05.13T21.26\Native\STUBEXE\@SYSTEM@\Sys\ANUH.exe"C:\Windows\system32\Sys\ANUH.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5d745d4edc5ca9a3d64e88fbb4ce07fdf
SHA1166fed9ea632a489a0e5ecca3eb23546dce3f2fc
SHA25681f2e34f8db48a759aea9f9b68b0eb0bff7f49ab444f89492a336d06ef7684a7
SHA51287a1f95775ee37d390d0770d153ffd4bf1fd28600c5ebf6e351020f4da0a35a162cc38ac652e45178b5846fda5c1e799bf4badc6ba7151d48c1e5c70126936e8
-
Filesize
17KB
MD5e325cd0e3100e3a452591969f29e3689
SHA1abbbe66de78db149a8d1902f731adaf7d367bf55
SHA25625b13cdae8d3b05ab354b5f96ba3f9f3f71ad2060c846cb234e66c6127ce4ec5
SHA51296937aff1f74334268889bece71f11a4c5258f64badd53329813929e4140d03472564a1f14c8bf24cd73aa20ab39bcb7b974496fd71de5e5cd58516f64259299
-
Filesize
390KB
MD5db485c0d252649c051970bf5c42167af
SHA1e5ca18b8e3d033cf27ed3c02bf893bd007767d43
SHA256a53287648d0a86577044a1ae0347a72c5e20b6a1087ba4e59b369209fa01498f
SHA512afab398e80e242967c081dc16b52834270f548a8dc453e337d7e275ae78b104f0e82bb4968d570286a605e3c3bb0fccead70ef0abb8e33de3f6a648fe4d3120f
-
Filesize
454B
MD5ed86f46d6f9edac62d0faf7443e0b4c7
SHA1c343ee61dc8ef4a34b1eef98d3a449b6bf4eb2c9
SHA2567ab23f84d1ff2e3bef3b4a0b775ee9a329e89179d02632914bce7063214f4beb
SHA51279388814fe5df2d73803e3c00d3c43761de4def6d5bd8edbed66eefda85829a301bd87d0031d1e9bc356b8644eeb60446301381100a64a9d8e9efc3e2cab5053
-
Filesize
5KB
MD50766f2291c9f350a0d3d70c25d4d0c23
SHA167d07f1963833e31c3406eddaf63da125e3478f4
SHA256d1f5c987db340dd00d620f546c7b89a1816d86d169a03bce9a3ff0f25207f8b5
SHA512ebfeedae7b5fdbd2f0e3f70ce42ee3eba6c464a1f314546b329e6b483e688c39daef8b010c7cf6d8eebc06db7560c77198b38b3166bb4dab146b8b46eb87b161
-
Filesize
4KB
MD584739b32b36267ca4ad9458d3fe6aff6
SHA157b7394c461b15f600554f57796397f2c65d2886
SHA256b82cb4c1d7766d8536cd19f3689ae7fd153df43ff5ac78244c1604d0fe96ba00
SHA5123aa1b092ff14b029386a26fabf095055cd371b21e726bd6a7fc94c2c6145dea151f78faa52e8eee1392d1d840176837a4f1bdc4a327c688fb462917876a324c8
-
Filesize
17KB
MD5910907d5df7d288d4a8fe0ddadd2f657
SHA1026caaee980bb16110ac7ba8828354b76dbcd5fe
SHA2567c9aef0e696b5a7b4c4f942b3dd3ecc0b64239788b32e11d760aa8eb8f9c4aea
SHA5121035c37f7e7b17d29db89533cdc1b512e6b71e5405e08e69c7cc830da8419e5f8fd61f0d191b2c8bff4c939c0e50ec5fb26a984a62a94c9f235a5c2a7c20af30
-
Filesize
7KB
MD5dc31755a645defcff561e0c96a13f004
SHA119f46782befe3fd743b8b0134bb711fd7b30cb82
SHA256674997f5cd56e9a013a97fcb4f5848f1aa20825e8f5989d5fb96bd4c32d21704
SHA5128cd892647011826408d764f6bea0f57317ff5d216d9c31bf9e6ead3329c14653dd2e84e91997f1cded78eca0012936779ee6f22a66c8923ce11ebc5269e1ee4b
-
Filesize
476KB
MD5b751c3555cdff47c29334fa53a449a45
SHA1ea8ae7c80619980f8271d44890ee5ac29febb3fc
SHA256c8b941cc547d4c79826626619a86852d29a56a70f3369e8bdd419b62e2b167c4
SHA512ab46e167e94cef76b3fbc3488ecdaa8cec8eff3b4d952cd69a225d2e237842d3f382342bc1226d0a777672361d1ff925582f58ecb8adbd836e4c2c1e3ccf441f
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
