Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 04:09

General

  • Target

    2a95dbddf924fe3aa25beedf25e06b8f_JaffaCakes118.exe

  • Size

    334KB

  • MD5

    2a95dbddf924fe3aa25beedf25e06b8f

  • SHA1

    a327c401ac7d75ce3e9e589ce56b9d1758a9be8e

  • SHA256

    bb3a3d3b17b79f8ed7ccc6319419daca6b909311214fb3e64cebdd437b3b6d3f

  • SHA512

    2ce2ddee6bcf72cac50154f5893b1fa03d08bf82cd173f74e0a2ad26ef19e5d41f3ea51a5027ac8f0decf7241dfb2b63ad76faccfb12c923ffc93b3c0c0a589d

  • SSDEEP

    6144:jov6KU9sVcPWy6ijms/PLCdwHhUA6h4aAhVsoM8KsQJGjnxjRkK6/x0N30pB1BJl:0P3hnJOxjx6/x0N3aB1rsE4i1hBBB+kH

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a95dbddf924fe3aa25beedf25e06b8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2a95dbddf924fe3aa25beedf25e06b8f_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Windows\SysWOW64\28463\LVGF.exe
      "C:\Windows\system32\28463\LVGF.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:532

Network

  • flag-us
    DNS
    73.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    94.65.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    94.65.42.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    73.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    73.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
    160 B
    1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    148 B
    128 B
    2
    1

    DNS Request

    172.210.232.199.in-addr.arpa

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    94.65.42.20.in-addr.arpa
    dns
    70 B
    156 B
    1
    1

    DNS Request

    94.65.42.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\@8906.tmp

    Filesize

    4KB

    MD5

    9dc64557fcebd521ca4b267da15c2914

    SHA1

    c2247f9e0f0c8d11c7b9ab93f43ed53943d0bdd2

    SHA256

    a49cb9cbab2a60418b2079d4110123682fc980bb6b46ac5ada144797b5fa2cf4

    SHA512

    00241a139ca307c5eb4d89fa8b6296833961091286282c3482746e4a3589ef61e6d007edb6aa6fa1ef812d57bf63a8e495e0db712e17decc77bbae2490cdbe01

  • C:\Windows\SysWOW64\28463\LVGF.001

    Filesize

    418B

    MD5

    02586730f520a1d5cd410f07a839cf91

    SHA1

    ebe96fec7a4d8022d810b2ff54762604e79824ac

    SHA256

    245aa72e2da7d2cf49d88920ac4723fc596d8ec58c9a96ffa1dbbae6118838d5

    SHA512

    203a2e9b3563e778d7fd3e28ee6cd2595f0817de78b4d93cb3337a1d581a053592acbec82fef13b6909a2131528a0e2237483d3a3354cd5710aeff60d51c63d4

  • C:\Windows\SysWOW64\28463\LVGF.006

    Filesize

    8KB

    MD5

    86d96c93965255cef35ca42413188b75

    SHA1

    9d77f203267febe047d049584e5c79f1c1801b2d

    SHA256

    b796bd1f5cdb1d1db91c3aca1ac700c015775b9caf2725fbf4b6089a096f21c5

    SHA512

    2db81080a16494ec549f4f39ee382580ba12cd5cbfe31632c8459ba94d767ce1ad3e9c0e6643f80530ae5e316fc42dca05708eeade7ce3c0341d669325cdb095

  • C:\Windows\SysWOW64\28463\LVGF.007

    Filesize

    5KB

    MD5

    b73942c11844487ca7fc3e78062c8abb

    SHA1

    28f4c4159528ccbe9d83b5cd5e157861d11ff04c

    SHA256

    4ba88f8964ee02a395d88974fd43b05610cf520b4ab40f36b3f98715ce1e0984

    SHA512

    d4c782f5abd91b3396b243345f968eb5a705a7aefeedf92e62047309f7ccf223c0825623c184de66e3667c22eb371f0329be97ea70f6d72b54f98b22042e1f9c

  • C:\Windows\SysWOW64\28463\LVGF.exe

    Filesize

    472KB

    MD5

    324154483b20e6f67a3c1486e3fc7c6a

    SHA1

    d6630eb1d8555b48413434b4a5d54c8de819cbf8

    SHA256

    ded1c934280294375d7b926773511e4d5e6c8dbb22b0dd25a80a6b0b3af065d3

    SHA512

    36349f7c53b9989eac63e8c91b7fb009a5a0dce934242ae5956a5e3d3764949a87296adeba81f3da96b5e035f3755b4dd75de2ffa211b7db296313c52f6d478b

  • memory/532-21-0x0000000000C00000-0x0000000000C01000-memory.dmp

    Filesize

    4KB

  • memory/532-25-0x0000000000C00000-0x0000000000C01000-memory.dmp

    Filesize

    4KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.