Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-11-2024 13:41

General

  • Target

    8bc44af6997059d6666b00900ba78657_JaffaCakes118.exe

  • Size

    479KB

  • MD5

    8bc44af6997059d6666b00900ba78657

  • SHA1

    7ac8986ca8ac0d1d73fe1834e93583052fa046de

  • SHA256

    ed0394a61e0d191948bf5f76244e0f1d0c95027e30d77499d89a8c0e8c6027f9

  • SHA512

    6320d9c11cb3ea21c259da707e4308c15c37d133afab016ae3eff5bc49393b511d638a63d14e938100f757941d1174a9224ad1aa12b6ab3bbd43d4c8d7681b10

  • SSDEEP

    12288:LASPvz5+7HbMcSTPs/HpftTLEXppUT/LQYKT5/:kMbAXMcEPaJFXYp2EYKTZ

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bc44af6997059d6666b00900ba78657_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8bc44af6997059d6666b00900ba78657_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\28463\AGGQ.exe
      "C:\Windows\system32\28463\AGGQ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\28463\AGGQ.001

    Filesize

    448B

    MD5

    05b36c5462e9d810e33ed689ead78e24

    SHA1

    6aed478e7b36196684d43448e7c443ee0662f92d

    SHA256

    33b1a94bb11e14f42de9212b4a1a54fc4091e0b0879186c0268df2e2980cb387

    SHA512

    e43023d15bd6ea335be9c0954c8e036c10c6dcf6794324982c293706f9e305b4c8299525c0cf098835a29b1f0947bb5b02a289ccd523995796159bcf6f4576fc

  • C:\Windows\SysWOW64\28463\AGGQ.006

    Filesize

    7KB

    MD5

    9bb764979044a263709a095f707fbf7f

    SHA1

    6a6ff5611d93c860401b165ff85957fbb340f14c

    SHA256

    6f55fcdfbdba9aef5252dfbb9a0f1ac9c83dac472659223ae5a7840484e2d95b

    SHA512

    a764c11ce03910f372ab7a19f251dbfcd369ad59a7e19b8f1a5825ef44f263d0c693f6bb69332bcb545ea397fc10497cbe4a83402a60971a07bdeb01ce19c057

  • C:\Windows\SysWOW64\28463\AGGQ.007

    Filesize

    5KB

    MD5

    c14f089be45a2669a608c0cb4b5ed402

    SHA1

    6c3168f0af173afbc295848ad1bdb480c510097c

    SHA256

    dfd377848164271d02259d4481e7978a12392f71f7bcadaecae247d962127d08

    SHA512

    3c3bc020b74bd76eaa7b5fe577371fef420a62afa9512ef6a0d148b902fe98f8372358ab0f1213e389ad44d52a631ed117a6921be51d66734059cbfdef33ead9

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    393KB

    MD5

    1533823edeb16a2f6130b0eac0a74b1a

    SHA1

    c00306974e0acda509d547d8947abbd19e848827

    SHA256

    e330dedede24e626c90b2894697df4d81228d583203b80775de310dd315f6a9a

    SHA512

    2d72b0b822de528943348881aa2f0855ef4d306df52f343ebbd8d8b8845da4a79a01efd88c1abf7645e4a72c4069d6d5d4c4d85f1dcd580ac61a9e2657303a87

  • \Users\Admin\AppData\Local\Temp\@C7B2.tmp

    Filesize

    4KB

    MD5

    67ce8b2ea53b0aa6ec6213a2b62b9d95

    SHA1

    e4ac32be20e72d1c12d0ba6919d5fd209a85d009

    SHA256

    2daed63cd25eb939ae46c5a1caf7fe07bde609a859720884b51d324ff45fc4f6

    SHA512

    760bef7efb0750d860909f2c92ef2190d7a63b8d07d83ba17997a2cd5c92f509f6c645d86bfbf22c3baff8ebabbf14856f8f4998b9d7132db19785190071c29e

  • \Windows\SysWOW64\28463\AGGQ.exe

    Filesize

    472KB

    MD5

    a10c0ee1f0006cd3f58809ee8a6ab81f

    SHA1

    c4dcb5bffaaea97f7c6d850905a03c001a452d9a

    SHA256

    9ae3fe10cb437ef5f98a8731c63cd21a3a0791d231428bd264422acd4b57268f

    SHA512

    ece264bd37989f52bef0446f378b9c7f2d9f8b6af52cf9ba9234540b2a51b3b0faaa7f3e99ee854371a91650105660deeb0748a82d29733b5f69de15ba8a4157

  • memory/1932-24-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1932-27-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB