Analysis
-
max time kernel
144s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 05:26
Static task
static1
Behavioral task
behavioral1
Sample
89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe
-
Size
717KB
-
MD5
89d6e3513424b1df8375eb7c6c8d9692
-
SHA1
6a3c22e512eff2c468832a071850ed7cf0989340
-
SHA256
7473e4aece71e09a6aaa41070eba6ddc1c311aac9c5c31b3dcfff5ead24ed3c6
-
SHA512
cc11acee60eaf5429db63a06b6e9737a6a839ab97a1b1b658d80ed83965b5709e3b53899b08c3116b70251cc5d02c83b32288df295d94f38e1ab28b97570c4be
-
SSDEEP
12288:tT2Xu16FQBWwqpiA3Z168xRWlSiYLsL1AroiNXhvVFvn462ME4WmwD:J2S8xwqr3T7xRsl12NRD/yQY
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x00070000000193e1-9.dat family_ardamax -
Executes dropped EXE 2 IoCs
pid Process 2912 AWAC.exe 288 MultiHack PrivateServer by ugo1995.exe -
Loads dropped DLL 8 IoCs
pid Process 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 2912 AWAC.exe 2912 AWAC.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AWAC Agent = "C:\\Windows\\SysWOW64\\28463\\AWAC.exe" AWAC.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\AKV.exe 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 AWAC.exe File created C:\Windows\SysWOW64\28463\AWAC.001 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AWAC.006 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AWAC.007 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AWAC.exe 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MultiHack PrivateServer by ugo1995.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe 288 MultiHack PrivateServer by ugo1995.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 288 MultiHack PrivateServer by ugo1995.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 2912 AWAC.exe Token: SeIncBasePriorityPrivilege 2912 AWAC.exe Token: SeDebugPrivilege 288 MultiHack PrivateServer by ugo1995.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2912 AWAC.exe 2912 AWAC.exe 2912 AWAC.exe 2912 AWAC.exe 2912 AWAC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2912 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 31 PID 2232 wrote to memory of 2912 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 31 PID 2232 wrote to memory of 2912 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 31 PID 2232 wrote to memory of 2912 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 31 PID 2232 wrote to memory of 288 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 32 PID 2232 wrote to memory of 288 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 32 PID 2232 wrote to memory of 288 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 32 PID 2232 wrote to memory of 288 2232 89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\89d6e3513424b1df8375eb7c6c8d9692_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\28463\AWAC.exe"C:\Windows\system32\28463\AWAC.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\MultiHack PrivateServer by ugo1995.exe"C:\Users\Admin\AppData\Local\Temp\MultiHack PrivateServer by ugo1995.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:288
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD5d63cc8679a63448db1c64252e14e4ab5
SHA110b3a9ac4bc16e8ac1cd05e50b4d540fa3ef223e
SHA25629b3646a556879a4a48e4f2f81e09179c34ac2051ed3e4f4c28e293092470d3d
SHA512cb1911e1a77fb9be560aa4fd8bbef65e181b6d4438d65657501dbcd8dbf488ba01738a7222f35f8d4317e8df8c6f307d9e3623d6e3e45753e138b80fb68ff768
-
Filesize
390B
MD5b886a2303039cfd99697496219408cc8
SHA1f6eb472512d6e50eded597d74568059b7a083dcf
SHA25699df08245e5452d947e1908eaced11c244b1c19060a954d0ef32f2bddbead616
SHA51251d7e33db3c8b9fd41c1c29d83fb9297e290973634e12fb76acd758dcf73083e896e2c9d45fdc2aeed853e1bccae32634184512d695d84f7270e586f3455d5f5
-
Filesize
8KB
MD581e20f4361cf8f5a57812871c24d945e
SHA15d7877d6959ab26599b05795a71633f00c37a3da
SHA256e6e8b4a29dccb3531f58c75b754caf7f26afe3e7043239305fd0ae7ab2f7571d
SHA51269b1d75ab7123054bf98cf3a0f2cc7a0749cda8d85ebdef85be7d89f1454154ce29070907b934727a6c5276ff430e94810b87a5634d25d8529df9ee36fd20818
-
Filesize
5KB
MD5e9fbdcc2f5fb657fa519b3f5c69fc52d
SHA1c49cca77b46a59d620711de7564d43e5dafcd2b5
SHA256cc440cfc4ce1a1ff503cc9e8937c59aae64bfce4daa3e7dc757220a25cadc2e4
SHA512913759967e16b99d8ea66433e5dc99d5ddbf737be6784306e67c2b23a525b7a578fcae1028221d3209abc452ff30508eb750c62113c3868a7af36b544e525fb1
-
Filesize
4KB
MD525530555085337eb644b061f239aa9d4
SHA18d91e099aba5439d4bfa8bce464c94e3e1acf620
SHA2563fb6b438ad1530abdd068bffb303fb8a4de51430e0e18ddb6b1a0469ffab8325
SHA512b1f9de0c276533a5a7070aeb2b6415cc1c0bdd2baf5e0645c6ac5ba767cab0d76e5b4461800d89724992af2c863294ada3c1eb2e4516183fe2010c33d47d6a2a
-
Filesize
334KB
MD5d1012b4c05949627760031b361048e45
SHA1b04600c4ce3ffb21611d1f3483b87534b0450636
SHA256e4405db7277ecc74955e7136ea5e65f16e43dd0a78a88283546ebbf00646ba2d
SHA5126d9b67661fc32ca69052ca12a35cc6c4be88b778c8ecf3414c4a1c54c14d7f04b6b952700648b4a805be914b41f807e1084860a095ed0b12ab96f1a4014fa9c5
-
Filesize
473KB
MD597d8ad45f48b4b28a93aab94699b7168
SHA18b69b7fd7c008b95d12386f6da415097e72151de
SHA256661df22a66b2062b233eb0bd9665de924cfe0ac9c6ba29e20ffef24f817f9331
SHA5123351eac970bab391de410fcf1937da75d2e4722b808f10332f487ddfe469544e32e7d4ed0e5bdc19bd5f472cffcc55ca1498c95945b4e9c4ceff6ff5cc521c8a