Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
05-10-2024 09:01
General
-
Target
1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
1709e7af5a45280e565fa95f331404b0
-
SHA1
e30a3c9ba1a0feb4050ff28dec9b8f066972ae5e
-
SHA256
df77f23a93811be258c168169a6245c3a7c8ee7d37801b985c9e745e88f2c5fd
-
SHA512
65b4a2f0df5f776d9f9e5fb55585395deb20101a370e49e2e16764d6d9ee83756e440b894696fd58daf27119324b9a7c7279e18ca4023373dc41ef6a0eaf0296
-
SSDEEP
24576:/ReoHLlYd7vb63wWgombBhfJgey3U5DY/ohuQW/t3jt/g3FsK06G:QohY1vqU1bBhfm0O1v/g3Fn/G
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 5 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1709e7af5a45280e565fa95f331404b0_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\DIVI.exe"C:\Windows\system32\28463\DIVI.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5a33680859a24229dc931c0e8a82ae84a
SHA1dff1e7e7160ffbfaae221cd3a85de40722fddde6
SHA256d5913b88289154f5979c03325b29f00d1d8c6a1e5f6195df915d96a46d0f71f3
SHA512a419214699ab3478926fbb7f621a616e192eae22db20e72c83a4b529ba5307ab4dc906e0b1286bc4e4cb13ba1e28fb93fa4918c3ff7345273197e39c206c10bf
-
Filesize
1.5MB
MD5545ae8f2d286615ce2c143284e446ffe
SHA1e0c41db5ae6835cfabd402052b10651a2c72feb8
SHA256be7b8f20c58a171b15fb2001870380e2b1bc9a5fe926172cf908c3017af53180
SHA512ed7d6d61289101e8291ce99991d5e612b3dad44f331ac0754f71f2c910f76f4b9966aba4025fe73eec1ef450a8a206802a7b8edfe11ed27feb982b53d8b46d18
-
Filesize
393KB
MD51e13f68fd4258a545d262c77e38c76cd
SHA1b8f6710c83e52ad354d8763a1b51293ee5758956
SHA256d7785409d6e2512d9d907670f79b313192a85138707c6ca0cc59a71f8fd6a247
SHA512938880407818a1489ecb9911cf05d4c9b69ecb2e0f908c3d3b8ba87b8c437ae16916e46bdf780bba24c38ad2c3981a5dcd4d3acd8ea227ac4dced12f1ca21eb3
-
Filesize
380B
MD527aff5a3ef3cd098c5c361dfbe80c75b
SHA1237659b5bdc3f89c835459e6042909aeb95344b6
SHA2569dae7ebf7fbc9c31ae865d50b7003b25abf3dc2cf90a865fe219e4300af7a8f2
SHA512cff865341279dea2c648a9a8692968c5d770fca54a5c2db453bea53fe8bef285125958508676e46f4962455befb24dcff264dc730d2f62ad7678af7d32f00011
-
Filesize
7KB
MD546e0f5831dfe24c3105ef20190c5f0d7
SHA1dbd701062695f9df971bffc1fa433eb18ef61727
SHA256d7c7932d10e19ebde38c50583b4f5a0215a0ac88a2b131ea1b2a97824af759f9
SHA5123dbe9e90f989ae3939d304f9f7822c3886e2d76ef575162e6a0518b61f5a52fcd8d0c63e06bbcf920c6f8298cb918ef5f3c0b92d42e99fa3eaabd787fc686a61
-
Filesize
5KB
MD570c68ec7e4e7f18abf35d47976a47f0f
SHA1f1263f67e712760e055833d3030ed4583611ad6f
SHA256cb8664787c631611643518ca2853f10ba9d460c25e476f55fb1b9f79838801fb
SHA51280cad83643c9c83be70809eebb4b662f58a323cbd5f1bfbc328722fbfa16f1a846f9ef159552a066850f12157cb7388d6ab37ea6f4e7563fff7cc26258b77a81
-
Filesize
471KB
MD5328ef8c28309203cfbe5655274d5ea48
SHA1403399787e94f7d4e3c8e237e25399263e9f4047
SHA2560f92918405d195ce10b0c897f07a73493d06e9e49505371a525d50cea75213bb
SHA51293dde6ab2d06af2d09b7f52619f2f475912152bbfd4b4ff93796eeffe7363f0ee777f4a46edb808039466fe0f82036dc291a378d4a8c6e407f0e1d4f3f6ea40a
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
84KB
-
Filesize
168KB
-
Filesize
84KB