Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-11-2024 23:47
General
-
Target
887e4fbd329e5238367e5c73033ed2e5_JaffaCakes118.exe
-
Size
4.3MB
-
MD5
887e4fbd329e5238367e5c73033ed2e5
-
SHA1
20ebd911eee996e569beb2dd51b35f775a5e0c06
-
SHA256
e1eceb0b8bdf4631690be12d1488df50b9babb9e5600f0bed39e42e3c885fcbc
-
SHA512
2bdd1c95ae7fdeae2479d3cce3b7e72d4f645fde291644531a9d2f5ca83c465e9154371f9ca8447af14e60925fd4f201ae9de199ed6b9bb0dadce8ebea26889c
-
SSDEEP
98304:L/394YXd94uVCpx18A4clyK5ms6TvaYP1DpQiQhV8eVmqkly/h:54YEuVCXp4cMiLYPPiUeVm4h
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 44 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\887e4fbd329e5238367e5c73033ed2e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\887e4fbd329e5238367e5c73033ed2e5_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\ALE.EXE"C:\Windows\ALE.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\FLRV.exe"C:\Windows\system32\28463\FLRV.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5d73d89b1ea433724795b3d2b524f596c
SHA1213514f48ece9f074266b122ee2d06e842871c8c
SHA2568aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6
SHA5128b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41
-
Filesize
783KB
MD5c57e6e9bcf0c0252692a379082353555
SHA10d30ba2da6bd3366a4c4f06fccc624989c3df425
SHA256a0fdf80be32bd36f13b5d0fc53400e33bf84e64d0c8955fc7f88ed77475bdf4e
SHA51217aa5f1c6a7df4d80e3179bb8ed3aa55ae680450beba57a583e2d9f326bb352dc336ad25209b157a33309a7831eee0c773f2eaa2975c3a38a2b0a361146d796f
-
Filesize
457KB
MD597eee85d1aebf93d5d9400cb4e9c771b
SHA126fa2bf5fce2d86b891ac0741a6999bff31397de
SHA25630df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24
SHA5128cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6
-
Filesize
444B
MD51c9c169d8bde064ed8770d4be13be8d4
SHA1868d4b8efc748117f2b4d17e60328c0fe610a203
SHA256816c7eaf58d1d635afebe3cc21324970cfb51b249e9ba0806cb013046ef6422c
SHA512b1e34a8510e58ef4f999019ccafc863591e5934b48b4332a019aa9e7d25edd82b125cb138d5a77a84005986b5221d7f78fcf6827bb36fd8e82c5e04cabb9377c
-
Filesize
8KB
MD535b24c473bdcdb4411e326c6c437e8ed
SHA1ec1055365bc2a66e52de2d66d24d742863c1ce3d
SHA2564530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617
SHA51232722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de
-
Filesize
5KB
MD5a8e19de6669e831956049685225058a8
SHA16d2546d49d92b18591ad4fedbc92626686e7e979
SHA25634856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564
SHA5125c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8
-
Filesize
646KB
MD5b863a9ac3bcdcde2fd7408944d5bf976
SHA14bd106cd9aefdf2b51f91079760855e04f73f3b0
SHA2560fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0
SHA5124b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a
-
Filesize
106B
MD5639d75ab6799987dff4f0cf79fa70c76
SHA1be2678476d07f78bb81e8813c9ee2bfff7cc7efb
SHA256fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98
SHA5124b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2
-
Filesize
4.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
892KB