Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-10-2024 03:24
General
-
Target
1b353bf884852c093cc15a9e5bf88ba1_JaffaCakes118.exe
-
Size
390KB
-
MD5
1b353bf884852c093cc15a9e5bf88ba1
-
SHA1
7d5278583e8cacfd1624619282cc02a2aedb861d
-
SHA256
a62f325139cbfa63063824173e01eeaf31b83a785ab0e30efe414665bd32aa11
-
SHA512
95bc604cf94a807a7648c97cb3c6df99b9e6ad126cdcf185ccb02b6cecb9769fc27b0b88210819f157ba83235dccd3458ea0e9cf5f229d93de4ff486c123890f
-
SSDEEP
12288:2/4zdlKlLDDeS+OGYI9RMooXhdnsN60juQ3:FnKlKAGFTMa6PQ3
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 10 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b353bf884852c093cc15a9e5bf88ba1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b353bf884852c093cc15a9e5bf88ba1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\GOVN.exe"C:\Windows\system32\28463\GOVN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Elfbot Scripts.exe"C:\Users\Admin\AppData\Local\Temp\Elfbot Scripts.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392B
MD59c51088174085d3e12a0f8abcfb267ac
SHA1533a791b8efa8d235e6af3f19fdc02767aee0612
SHA256012f18324590cc0a475143a3a219c7b4d6ce349c40607da9c4173da54d7d714a
SHA512ac653b78d52e3a81fca43c0e7f0c46a2e046ec4ab56e130c8b176a839da72f444b12dfae61d8e7d5e42f925554d41b58358cc7bdc05ff70a2f48f3bf506f3eea
-
Filesize
8KB
MD586d96c93965255cef35ca42413188b75
SHA19d77f203267febe047d049584e5c79f1c1801b2d
SHA256b796bd1f5cdb1d1db91c3aca1ac700c015775b9caf2725fbf4b6089a096f21c5
SHA5122db81080a16494ec549f4f39ee382580ba12cd5cbfe31632c8459ba94d767ce1ad3e9c0e6643f80530ae5e316fc42dca05708eeade7ce3c0341d669325cdb095
-
Filesize
5KB
MD5b73942c11844487ca7fc3e78062c8abb
SHA128f4c4159528ccbe9d83b5cd5e157861d11ff04c
SHA2564ba88f8964ee02a395d88974fd43b05610cf520b4ab40f36b3f98715ce1e0984
SHA512d4c782f5abd91b3396b243345f968eb5a705a7aefeedf92e62047309f7ccf223c0825623c184de66e3667c22eb371f0329be97ea70f6d72b54f98b22042e1f9c
-
Filesize
4KB
MD59dc64557fcebd521ca4b267da15c2914
SHA1c2247f9e0f0c8d11c7b9ab93f43ed53943d0bdd2
SHA256a49cb9cbab2a60418b2079d4110123682fc980bb6b46ac5ada144797b5fa2cf4
SHA51200241a139ca307c5eb4d89fa8b6296833961091286282c3482746e4a3589ef61e6d007edb6aa6fa1ef812d57bf63a8e495e0db712e17decc77bbae2490cdbe01
-
Filesize
164KB
MD5090f3f53d08fbd780f3f74c7b5f93391
SHA1cb5f9a49c668e65a0c38d128b26358f3cda2d9fa
SHA256949a04e62bfdbd4465e534a2c863a91eba59e376ef7450f6852ab1ac62d5540d
SHA5128b056e6e7989ba9c38f76aaa825011eefc2c862fc8ee90516703157f2c6131adb3d7ccde8c8b92cc0ab87d0180d72de5e1d331c7c04347cf04d66face2c4ecaa
-
Filesize
472KB
MD5324154483b20e6f67a3c1486e3fc7c6a
SHA1d6630eb1d8555b48413434b4a5d54c8de819cbf8
SHA256ded1c934280294375d7b926773511e4d5e6c8dbb22b0dd25a80a6b0b3af065d3
SHA51236349f7c53b9989eac63e8c91b7fb009a5a0dce934242ae5956a5e3d3764949a87296adeba81f3da96b5e035f3755b4dd75de2ffa211b7db296313c52f6d478b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB