Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01-11-2024 08:03
General
-
Target
844a132b6bb4b45ccdc2642e570b317d_JaffaCakes118.exe
-
Size
788KB
-
MD5
844a132b6bb4b45ccdc2642e570b317d
-
SHA1
5c334015c6286d1951d299f90c8ed1e72ccaeafe
-
SHA256
80f24e892c071c655bc2bba7ae3a8afa55089018a08932f5ee0c399c7888f558
-
SHA512
954b312c080e4458d39bb5f09fa191737f5516ecd125d2c38cfee763db0830b1fba7ac86cbaba44164c443198141c9a6d11a0896a8021de7403e791dacac51e4
-
SSDEEP
24576:um3wm7VItg/gjZK3sZSv7aJJvCOn9RDoG:V/8g/gM3sZSv2bqOn9RDl
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 43 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\844a132b6bb4b45ccdc2642e570b317d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\844a132b6bb4b45ccdc2642e570b317d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\JFBR.exe"C:\Windows\system32\28463\JFBR.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457KB
MD5f34b87951e1a931e01df1bc9f1b98207
SHA1f3cc94e72bf7e9bf2afa7d8dbfef0ca2087358a1
SHA256e6cf7cdc5895da8a65f8c4a1a1d0d0583218a1c28f66d25dc56fa67f9c34ed5b
SHA512c2438d88489b9ed7c6c875ecde07411a488eac9115358c73f72d7029874f75803ebead03a41692a900648fb2b2be63b7c8b4e3a71984261185b6d5d6d7201641
-
Filesize
478B
MD58047717026d2e914c81bf69bfb4febb5
SHA13f7e307dabbdc6adfb6fec4da9cfda4b4cc21d42
SHA256cf44e6503ca09eb184994ca985a25193724afeca41ee531af9a2233daf669795
SHA51241d6d087e0d239df87cf9561b9e8d6233fdd61a35b770007ef42dda10d2d2efaf15ae8502bc118be7ddca9251a70dad3ba79873c9b94394edc9acaf04782d6d5
-
Filesize
5KB
MD515eb312db4b3e208b67082653acb8a02
SHA1b0926b1e1733baa3d7f18d3806916f92704fccff
SHA25672347b6d619bc7204a155486e4d09a62a4a494c35a8121349bfe2fecd5af99a8
SHA5127e8d451bc9d1e83615db15d6cdf68230cdd333fa38362979f0408dc80bf680859a2bc3fc09c494805731317b0f136c3227226092f1bcc31c2c80cb73071aa443
-
Filesize
290KB
MD5f3127b08683e2e1961cf0e5bafce8d80
SHA1ecaf8bb6f3505af410ac63b5ce0ce3cd070a5250
SHA25604df44a5c62f4bf5dd0e265d8a6a70fe1b29a80de6cd2ba6d6c34fdbda8d0beb
SHA5129cd30abf1e854b9d10ae62ae2e12580a94fb1e196648a29cc9b639a801d0201324f0b4cfc0f7c2da2ddeedc71985dd8cf8b1472ab07072384627eec97b9f1198
-
Filesize
92KB
MD58340bdbd5f1b935964b545f0c205b03b
SHA1048ea39201b2f203d331b04f6962d0079262ebbe
SHA256fe5dd5c73a8bf5e7db2994c97864a1c00a45baf4a3e3235fc1e8d1a54776ef53
SHA512784eea4e09555669a19e647ea87eb85ef1c35586773c8c696d1dc610d4e5e778a97d33d55c194cc762fcccc86bb02c350fc9386374a2944c130794f18ab30e65
-
Filesize
105B
MD527c90d4d9b049f4cd00f32ed1d2e5baf
SHA1338a3ea8f1e929d8916ece9b6e91e697eb562550
SHA256172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb
SHA512d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae
-
Filesize
4KB
MD536400e746829504282eb26b364826aa9
SHA1d39ea9da98be0c331fd71002645f4f40664288a2
SHA256c7ab756437211f6e0e3dcd7482bc67cb910e504345902049eb8abe34a656deb0
SHA5125fe8fae2f5fcbd42c72cc8f6dd70aeec0afd94af5cfd905441630755790dc6ed346823ee009c21537b9cdb3b7b7a39eeed933606726ffd891dae47b60465f640
-
Filesize
8KB
MD598d22fb2035a26a6b9b7decc0c0ff2fa
SHA143a75cf59fc2f8b59b1d962b4e685249eef816d5
SHA256fd5c03fd9ea47c1e820d19bd307ad7c4e53f4b65d288cb675b05cbe76c9b5c25
SHA5123cb7f765d6f4d1dc08a0087086f3fe243bd8ff9e699607cf1e4177892576665c0c799307751cba16fd3f1482e5abb884090024431be2ce86d4080f1d1134d91f
-
Filesize
651KB
MD5b181beaba4204ac3ce7bc8e6f0b74312
SHA14ab13763d2ecdf0968f15a39302aab2b1f0ab462
SHA256f36bad234fd1599dd1398d20bc57499314fe96d5de20074536067b2d3c2b4f2d
SHA512d1aaa2fd25e53986c8ea8213a8a02515927c9e9aa3e4d8077a138a29ba32c807ec81473b672a22ffb6ba26126ccd7e1d310e057ef964d3b21b1672a67af5fd7b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
360KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB
