ardamax | ee59f1c354acb7693b6084a65a3f5bd955f2d22a8c15318671bd5d2e5eb390dc

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe
Size

1.3MB
MD5

7897b657b549d7bece1f4eba26529a5d
SHA1

6e3b8704af7560254e5c9dafb88c20e6f372f5ed
SHA256

ee59f1c354acb7693b6084a65a3f5bd955f2d22a8c15318671bd5d2e5eb390dc
SHA512

ca8a65e30c48b250be7a2f6062650fbbfacf4869cb36617e26ca0f8b353ea0f65b8c557e1600f92fc169e67ce68c57d60b49d32bd11bbfad61ebd9034a2923b4
SSDEEP

24576:grHRqUW1BYrRh4jd3e1B/EYCfGMuAflTn7Lzrws4p4TFk/GiVWWd5kSOW:grHRfW1BYw3e1B/Xg/uAflTnLrwsywmb

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000017491-35.dat	family_ardamax

Executes dropped EXE 3 IoCs

pid	Process
704	explore.exe
792	PAYMENT SLIP.exe
2696	FVF.exe

Loads dropped DLL 11 IoCs

pid	Process
704	explore.exe
704	explore.exe
704	explore.exe
704	explore.exe
792	PAYMENT SLIP.exe
792	PAYMENT SLIP.exe
792	PAYMENT SLIP.exe
2696	FVF.exe
2696	FVF.exe
2696	FVF.exe
2688	AcroRd32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FVF Start = "C:\\Windows\\SysWOW64\\MVFIFT\\FVF.exe"	FVF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MVFIFT\FVF.002	PAYMENT SLIP.exe
File created	C:\Windows\SysWOW64\MVFIFT\AKV.exe	PAYMENT SLIP.exe
File created	C:\Windows\SysWOW64\MVFIFT\FVF.exe	PAYMENT SLIP.exe
File opened for modification	C:\Windows\SysWOW64\MVFIFT\	FVF.exe
File created	C:\Windows\SysWOW64\MVFIFT\FVF.004	PAYMENT SLIP.exe
File created	C:\Windows\SysWOW64\MVFIFT\FVF.001	PAYMENT SLIP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAYMENT SLIP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FVF.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	FVF.exe
2696	FVF.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2688	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2696	FVF.exe
Token: SeIncBasePriorityPrivilege	2696	FVF.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	FVF.exe
2696	FVF.exe
2696	FVF.exe
2696	FVF.exe
2688	AcroRd32.exe
2688	AcroRd32.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 704	2164	7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe	31
PID 2164 wrote to memory of 704	2164	7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe	31
PID 2164 wrote to memory of 704	2164	7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe	31
PID 2164 wrote to memory of 704	2164	7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe	31
PID 2164 wrote to memory of 704	2164	7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe	31
PID 2164 wrote to memory of 704	2164	7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe	31
PID 2164 wrote to memory of 704	2164	7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe	31
PID 704 wrote to memory of 792	704	explore.exe	32
PID 704 wrote to memory of 792	704	explore.exe	32
PID 704 wrote to memory of 792	704	explore.exe	32
PID 704 wrote to memory of 792	704	explore.exe	32
PID 704 wrote to memory of 792	704	explore.exe	32
PID 704 wrote to memory of 792	704	explore.exe	32
PID 704 wrote to memory of 792	704	explore.exe	32
PID 704 wrote to memory of 2688	704	explore.exe	33
PID 704 wrote to memory of 2688	704	explore.exe	33
PID 704 wrote to memory of 2688	704	explore.exe	33
PID 704 wrote to memory of 2688	704	explore.exe	33
PID 704 wrote to memory of 2688	704	explore.exe	33
PID 704 wrote to memory of 2688	704	explore.exe	33
PID 704 wrote to memory of 2688	704	explore.exe	33
PID 792 wrote to memory of 2696	792	PAYMENT SLIP.exe	34
PID 792 wrote to memory of 2696	792	PAYMENT SLIP.exe	34
PID 792 wrote to memory of 2696	792	PAYMENT SLIP.exe	34
PID 792 wrote to memory of 2696	792	PAYMENT SLIP.exe	34
PID 792 wrote to memory of 2696	792	PAYMENT SLIP.exe	34
PID 792 wrote to memory of 2696	792	PAYMENT SLIP.exe	34
PID 792 wrote to memory of 2696	792	PAYMENT SLIP.exe	34

C:\Users\Admin\AppData\Local\Temp\7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7897b657b549d7bece1f4eba26529a5d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\explore.exe
  "C:\Users\Admin\AppData\Local\Temp\explore.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Users\Admin\AppData\Local\Temp\PAYMENT SLIP.exe
    "C:\Users\Admin\AppData\Local\Temp\PAYMENT SLIP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\SysWOW64\MVFIFT\FVF.exe
      "C:\Windows\system32\MVFIFT\FVF.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2696
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TT COPY.pdf"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TT COPY.pdf

Filesize
102KB

MD5
abe92b6faf82930249e978bb1eced7a2

SHA1
58570a506b2ce9d69b9542eb666144d5faf70af3

SHA256
19378f3e67ede578630f5d22df27d1f9b0375bee2705a031f71d3823efe9d04d

SHA512
5ea2ce19474c07710669dec4c67da84fdc45969f9fa0a7a7adb19468c655523d601f9f134991b9b099a2fc3564321c32e8da2d89ce84e744a592315067f78b2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\explore.exe

Filesize
1.3MB

MD5
2a889ee573126d117ae8f421f4b0ef80

SHA1
2197693be3cce6fd7027d545596a4131bbbcc900

SHA256
0e5c1bfcaee6957c27be741996ab5cd14bcfcb492bc07209d69b885309e8666e

SHA512
2f40098029eded022199e78eaba9df87eb16d6304f83e334eccd99eae0acb3c23a28b4a2e60c5382fb48a070dc6a4720361dfee7a90ca64aae6db3c7a71d2caf

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b6c6b4b6bd273da336a46d340a857049

SHA1
bdc21e34fd46c9e4d3d51960ce7efa5a0e676bba

SHA256
976b2fe9ee61bea577c5982136e89c4e65671ddfe4bca806753d1f29ff9d49be

SHA512
df4b42b0d8cccdee7744451c654e32ea6ffe015eeb20c0746f681bc06b84d68bda8994fdf7bc848b8aa109ba0995a05047e42b3c6b0426fe32c4dddfc6bc2aae

Download Submit
C:\Windows\SysWOW64\MVFIFT\AKV.exe

Filesize
489KB

MD5
0725c70d7b45945089905464a2710dc8

SHA1
a47223eb378919afc8c2a6af6b031bca12eacaae

SHA256
5340cf0385c1ccf9a5f01e9bbcb68474d5760c1c60bd87772fbd8a498208a3c5

SHA512
3b95b3c582c2df9a59c2aaa5e9f04ea093dda8b53a7df4b966d46c6f61643e8beed3e3cca0e784301f5f14ea17e2520ecf10dca0ae805e5b31bd51ac94d10888

Download Submit
C:\Windows\SysWOW64\MVFIFT\FVF.002

Filesize
44KB

MD5
1db8aa9ffda07a5f5559cbf25087147b

SHA1
eea77894bff8e24fb0861159927f67decb629184

SHA256
8cf369255b48195b8ecec1c7bf2e76924641880aa7311e6cf504ca534bbfcd62

SHA512
b9f80191dd8975c2e484eeec1bc7c6212d1b614061e69d96eda87b7a061a78a34de220f22607c3eb1c0fa37f152744a5c8f65a896e2884a9daf969db54a11704

Download Submit
C:\Windows\SysWOW64\MVFIFT\FVF.004

Filesize
1KB

MD5
58d3b4b51a4da90f88aa80b7d6d82d56

SHA1
3cf528bfd6588c4ade33586158b5ab3c71dae4ed

SHA256
b658d0e8de0f7515904c058c2cb7a88f1de207d6ea5cde8bed93b51a48fa133c

SHA512
f8ba2f031d047f91b243113f8d1a5b0dc2dd170edff3eef9659bb3a0c8703b40e6c11d6304e17e14c3f9fc2b4eb63702d70ac49055e144b2abd4bbde6b52ff4d

Download Submit
C:\Windows\SysWOW64\MVFIFT\FVF.exe

Filesize
1.7MB

MD5
7dc8f94e34ad6f38e94f957043c39617

SHA1
081a26dc478bd3de6f2889b9c8da8b2e79723d8b

SHA256
618fb51d23c0ca116dbd24dc5e0240ebda862e405283d64871549321fde08202

SHA512
539c239670369f34e7907d072bdf6b91becb927454db3212b0c307363289b1900edffa2f9fac22d3d14435fcee28b7bdeee1f039f027d74f84627c85774b9f56

Download Submit
\Users\Admin\AppData\Local\Temp\PAYMENT SLIP.exe

Filesize
1.2MB

MD5
9b1abc28205943c6c162690d44b1feac

SHA1
7b1ec5f066933948fb29e224258e428091c281ab

SHA256
b7a3a2f8457113309d842c507ce31a5d0d2720ebe570dc03c902d875db7a69c1

SHA512
4d257c9a859a064178aa1ca9025839a2227305fb4af6a1d93007390244d89f9069bb662c2a1e8086c2da2b5a526a5119a340765b58d3b42f7b313629cddb04e5

Download Submit
\Windows\SysWOW64\MVFIFT\FVF.001

Filesize
61KB

MD5
513c67ebf0379f75a6920540283a4579

SHA1
2fe191acb478d62026a8dbf63f65619d168ddee6

SHA256
8f636876880c59251548fca626731e648553e0b81b02f4667c22cbfadfbd6e30

SHA512
2330f5bbd8d7de91473430bc35a125fe13b261afa5b4ef9533d4d6ebcde6cfe27f705fccbdefa092eb9123eb33dcc1448deab72adab981726517afe458beb01d

Download Submit
memory/2164-0-0x000007FEF5F7E000-0x000007FEF5F7F000-memory.dmp

Filesize
4KB

Download
memory/2164-12-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/2164-3-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/2164-2-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/2164-1-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download