Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2024 17:10
Static task
static1
Behavioral task
behavioral1
Sample
18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe
-
Size
577KB
-
MD5
18f6f25facfe0463e9e7612115ffec26
-
SHA1
b234cfdd8e864ea215160c50e1327aa4fe96d194
-
SHA256
b2543f07bf1096e8f71e591de87bcc11ed5f6e94b5a661421776d8d1be209ba1
-
SHA512
6dc32e64a287de0a8a67105a7a8b059d87b0885234d25452152b99f888e9cf9083625a182c03c8c2c9259e78334cc5a27ba6b0524c8a4fe0c647897aa3c23ce3
-
SSDEEP
12288:iLlqNGnnORIYGPX0Q59KV7X4WvSywUe0A0:V4n6gPX0Q5mvSyB5A0
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023460-12.dat family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3172 PGIT.exe -
Loads dropped DLL 1 IoCs
pid Process 3876 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PGIT Agent = "C:\\Windows\\SysWOW64\\28463\\PGIT.exe" PGIT.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\PGIT.001 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\PGIT.006 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\PGIT.007 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\PGIT.exe 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AKV.exe 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGIT.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3876 wrote to memory of 3172 3876 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe 82 PID 3876 wrote to memory of 3172 3876 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe 82 PID 3876 wrote to memory of 3172 3876 18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18f6f25facfe0463e9e7612115ffec26_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\28463\PGIT.exe"C:\Windows\system32\28463\PGIT.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5102f90f4f42551b2acd64923065a2b56
SHA118bbbd1a10b603e05816f5a2baf9a6bed74346a3
SHA256623f4b9a4910c8815d2ab19696668258ff2c30c3adac8967d616f7e60ec619fd
SHA5122c8338799bcd64083dbe8b0e763424962dd024c52996bae590500b7d844595b539549b6c239f68f3866d5fda9db10808e8e9b489031a1e942bc34277f9a1d9d3
-
Filesize
411KB
MD538defc8742dcd7b684e5ae1193e7e668
SHA15710271eb398f63f0f0b209c46460ff9665df9bb
SHA256b74a277270efc272bef1e264dc11289b7f13c651ac7640745df46bf6792c36d1
SHA51246cc4b677af570905ac0c36b4e85030a618cefd6e4eb4eb4fc850ad2df45c14233024f0aa655e28649212aa42bf74499a91a682750748f75132aa18d1464cb84
-
Filesize
494B
MD593230ed7b414146c5169479b390677cc
SHA17337a42ae60c37625f669e4b511c2b9e3b9cfb55
SHA2564d7c1d47a4e2f0eb88105958696de54d918da377c2a7ebf110fdd8b3563ac6d2
SHA5120e241e9a1dc0efbe210041375983777e1c40baf4791b066901a12c8b9ecdc7722a45d3e2ce6b13caa6c85b5248fbd9e61e1fd436911803ec69e62b9ddf97ee56
-
Filesize
8KB
MD5e44628a2b8e2044ebb635eed3d5f79d9
SHA187120d6466ae60ea0df734c578f371c5c77acf3a
SHA2566742a87a0df8e620ff5314729c94cfaa738daf172220868cb748b09bb4e72ca4
SHA512ab1ec2ced331a14d60976338715cb9a09144b784d5c3fbcee139e85f843cab9aaa6627ae7a2f7f9d82cda5297fcc045e97385639397acb252bb18ebf315db37e
-
Filesize
5KB
MD575d6279af7fa9545ba7b7b01a85d2e12
SHA12fa39502b0aaa872712068747ff4f0800e955898
SHA256189a54410440caab60ed99dadf5fed2edcb0d36e5ed3e9a59be41026662bbc0e
SHA51226c21d6e68fef49d988d4e20da9df164760318087752d4d872275efdc0c667fc31426a916acb8eeb65a0acf20ce3bd3c8953bd34cd83cc46cf44c329469f2ae9
-
Filesize
526KB
MD5c4e65cee2c8eaf4a4c03852192f49156
SHA17c7b416d08056e2ecf215a6ce7126cf74ca3d87e
SHA25695b5415e32ec93a15a060b6e461151632764cc7693e9d3525e495aa3c9ae1fb0
SHA51259303381117ced1d99f67fbb10921e34f7ba066edb937ae6e27262941772a48fbe40b861a2954a1e40160b0661f1e2140377ee128ba9600715f6459b65c1bd72