Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
17-10-2024 11:34
General
-
Target
51e6d705ce99ff10e033894343553da9_JaffaCakes118.exe
-
Size
513KB
-
MD5
51e6d705ce99ff10e033894343553da9
-
SHA1
afc3ff76f8cc9115edf549141536dbb1b901c4e9
-
SHA256
74c3e730a91d2fd37d0a64795b493e4b5c1dfe42b4545e89d0a8667d194f13dc
-
SHA512
5976355bffdd7e9898ec342b2b8fed54c5ccd32f4ad14fa8f14563e51cbcd485684e28b9c153b24140082eab78be89b8d3b8a820788f2bf6e4f8e51afd1820e9
-
SSDEEP
12288:tF1SrMEhiwdjEQYCMuBy5U5Uo4EZ4yS6/Sp3qB5Wpkl7:tfiiEjEzCMi6+Z4Zp3qbE+
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 14 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 5 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51e6d705ce99ff10e033894343553da9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\51e6d705ce99ff10e033894343553da9_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Sys\svhost.exe"C:\Windows\system32\Sys\svhost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\ESLSpy.exe"C:\Users\Admin\AppData\Local\Temp\ESLSpy.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5b36a8146992ce3426270aa2200dd57ee
SHA1200d8e8a530ff7739a58e9cada42d6f423838a9c
SHA256914e327b1be6aa945219d08fa283d0234002223ac9826e92072a111461d86528
SHA5121e208ac62d626841e22f51f971366d2179a4be553eae51ee605df55dfe50f938632283b1a6d5a716aff754447938eebec9fb2d585740f8c961f8c013253a6328
-
Filesize
528B
MD56472d06ebf2c568fc47f3ae0d6614120
SHA15d25394dc9103fc87ead3410b3e699734d05d0c8
SHA2569784ecfa324fa18b20db18fd3993b941c383d14d00fae66770165c9a82f446b1
SHA51203805343863af6cb2780b36cb12f3d8207f62a92e9321cff81ac0ee62a661092c49b94f4db6775a462906fe56f1aec2594c6255a67d2db7dec83a0c1aff851a1
-
Filesize
3KB
MD5158534985cc97231207a7ceb4c76248c
SHA149d9d166cf618dcd4449214458148bc12dd1fc07
SHA256408962acd78a99edeaa5ffa5881ee736b0edf3d1f02a6fc2f12f2bfd47f7b4ae
SHA5123615e7472cac066c4dcae91c2ea5c78f93e587a2bc892d57dbfd277ab68051024b02995dd9543c5cf51a2626f78acbb4962a2d0ee7af1bddaf50a64a240456e0
-
Filesize
5KB
MD5ff2bc313174a6ccfe1e0b5b1a58f0f49
SHA14e983cdee788faf6a13a9d5bf3f00f4a17dd6e8e
SHA256f212c83897599d81f4010f1ef3a43e5709e874912072d38d26a5ef5644462318
SHA512418083066ba5505267f4de91c9e439674e02645c430360dae22dfc390c33b4e0c01857634d1dcb5dc298c296a5f4130397388bceee2ad82ba0a711ab56d1bd0f
-
Filesize
4KB
MD550c8c542dca77df82f5925b145567611
SHA164bdce386146e3548d3d85cf16fdd0d34cbafe2f
SHA2560692f76ec589e517f0a5205e658ca44656322c0382cee2af53890324818b3e0f
SHA512f7df5e9ac0c81f832e8dfe882eb1c4746f30131bef5a56947634146c813df079acd57b3fc954254684c6f4ef291802cd9629e6af3ced9be1f381fdd858a327c2
-
Filesize
72KB
MD5ab0835d1051bd63c3c6de976e1889973
SHA1ee28a59c843058bd9f89da601d2363588ad8a950
SHA256765a54d95e8b59150353e0bbb2a785ac1a2c9495ecf58dc3c436abc60c17a7da
SHA512c6e43217039d788099275a951579e0b5b914c95b0ce399e4e370f485c24ed4d2f795b67e67b1fbc103db0ec1b48d00282aee880f2a4977c321e0d0cb56b6d480
-
Filesize
4KB
MD5a9680f653434b4766fdc2a3c592af879
SHA1fd8e999c43fa83df3144aa5bbaae73bac3834296
SHA25630e084f531980a35b79dd36ac9ee0022d0aba792da99b3d71eea26d327db9ad3
SHA512685fe7bbaf9fe5d140f07e9fe0f1eff0cecf8a3a4d050fe917ce8eddac3394ab7b8cea575e2d6f3dace309716662fbb5a9016850b120ea2099a00cfc848f57ac
-
Filesize
345KB
MD52943f48755e623e5c4281b7cce7faab6
SHA191cebd616f6b913cf2d55058838d39f5e899f1b4
SHA2565f3c7fb14d9a47708aa13720b146e90f528c8c3226b8f976121491ba09ccdfd3
SHA51286eb88b697282f6b8e1085fc2dfd02d7611ed09170a81d209fc4d82dff8ef0f1c3ca9ee5e9b4fd810397f205c2d7061c28a907242e6a2da3f96ed7d0ef2987bf
-
Filesize
459KB
MD54db1b69341dc88b901d85be34278a634
SHA10d55d2852a58b597c96c1dcec25efc961d882ba1
SHA256c3f29e3f8b9eb7c20a0046fc105d2199dc5327a570e8c76908e44be1200fb893
SHA512e11ee43c65179a562254cc63fda5c25ae228603bd88fd357faea2a5b49b4df11dfde5efe46544ac138d008cdffc419c793b35781ef201a9462a9eda30b52dee0
-
Filesize
168KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB
-
Filesize
140KB