Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-10-2024 09:58
General
-
Target
2f1a8f822eef7aebec580f2bf5f66555_JaffaCakes118.exe
-
Size
646KB
-
MD5
2f1a8f822eef7aebec580f2bf5f66555
-
SHA1
a4b2173f8bbe11d92dc6534f760ff13d77f4dd8b
-
SHA256
09b682f6d836616919f565a99391abdf9986b1a0ebbc744628deb5fc3e7f40b2
-
SHA512
ccb899b5137d822d44b801b51d2399bc655af652438c230f4ef132d8c0ea9a985d41598b76f909ce8824134f16302bc8737cc8657b1b1c6de373c622ff4d9e8e
-
SSDEEP
12288:0DKZvj+2l3i6Vp+jtUvApvQS6FMlAEVpcWcsWApN63SdEmmfsH:QmpllVeqs4mbam6iSmf
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f1a8f822eef7aebec580f2bf5f66555_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f1a8f822eef7aebec580f2bf5f66555_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\HHVK.exe"C:\Windows\system32\28463\HHVK.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
528B
MD58a7cc28c282ec086c34a2c6c04157683
SHA1653e529f9fd518e0f66dbed78e2142632193a72b
SHA25674e75a8be24fb66195e6a25fb6773718c533b12d0489d1cad45ca4b7d8bd471b
SHA5125495b6e196d8990a82fa32662ee22521d23fe4e3dbfcd47f8cb327847fba8068b852055599eb20ecfeaa8c04fd1ff283010cca0dcb4028db9a59c6fdafb43d84
-
Filesize
478KB
MD5249e2adb3fbdb5c8124ffb674ebd5cf6
SHA142189b1b77ac8c17c736829530d59b84d0c64b4c
SHA25673f5e71c835f94eef3c673cbe433030df3eab702ccadf83a8432c47d7d506736
SHA512c976d72c1becba3bb7e05784eb6006fe1a85f6cca434790ccbd6951bdb24a51d5bc968c3bd5a930a0f71122eb913ada77e1e2b6b7431863d70e28fca2ef88046
-
Filesize
393KB
MD51e13f68fd4258a545d262c77e38c76cd
SHA1b8f6710c83e52ad354d8763a1b51293ee5758956
SHA256d7785409d6e2512d9d907670f79b313192a85138707c6ca0cc59a71f8fd6a247
SHA512938880407818a1489ecb9911cf05d4c9b69ecb2e0f908c3d3b8ba87b8c437ae16916e46bdf780bba24c38ad2c3981a5dcd4d3acd8ea227ac4dced12f1ca21eb3
-
Filesize
362B
MD501d274d845bb3bf62bfb2d6b7b1b46ce
SHA1ef5689efb9c80f1af0143f3b77a70a07ce31457f
SHA256ff8d2b9dac894b7356a5ddcf3e19412e448a67bec0c116f4d9dfdb0aaf635ee3
SHA5127672201daa322993ca41335100bdd60e401270100b6f31ac921f362794e94b806ea61c6a4a3718d216719b14145bc6b14a30f5f1e8a025f8be32778c82df07ce
-
Filesize
7KB
MD546e0f5831dfe24c3105ef20190c5f0d7
SHA1dbd701062695f9df971bffc1fa433eb18ef61727
SHA256d7c7932d10e19ebde38c50583b4f5a0215a0ac88a2b131ea1b2a97824af759f9
SHA5123dbe9e90f989ae3939d304f9f7822c3886e2d76ef575162e6a0518b61f5a52fcd8d0c63e06bbcf920c6f8298cb918ef5f3c0b92d42e99fa3eaabd787fc686a61
-
Filesize
5KB
MD570c68ec7e4e7f18abf35d47976a47f0f
SHA1f1263f67e712760e055833d3030ed4583611ad6f
SHA256cb8664787c631611643518ca2853f10ba9d460c25e476f55fb1b9f79838801fb
SHA51280cad83643c9c83be70809eebb4b662f58a323cbd5f1bfbc328722fbfa16f1a846f9ef159552a066850f12157cb7388d6ab37ea6f4e7563fff7cc26258b77a81
-
Filesize
4KB
MD5a33680859a24229dc931c0e8a82ae84a
SHA1dff1e7e7160ffbfaae221cd3a85de40722fddde6
SHA256d5913b88289154f5979c03325b29f00d1d8c6a1e5f6195df915d96a46d0f71f3
SHA512a419214699ab3478926fbb7f621a616e192eae22db20e72c83a4b529ba5307ab4dc906e0b1286bc4e4cb13ba1e28fb93fa4918c3ff7345273197e39c206c10bf
-
Filesize
471KB
MD5328ef8c28309203cfbe5655274d5ea48
SHA1403399787e94f7d4e3c8e237e25399263e9f4047
SHA2560f92918405d195ce10b0c897f07a73493d06e9e49505371a525d50cea75213bb
SHA51293dde6ab2d06af2d09b7f52619f2f475912152bbfd4b4ff93796eeffe7363f0ee777f4a46edb808039466fe0f82036dc291a378d4a8c6e407f0e1d4f3f6ea40a
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
4KB