Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    03-11-2024 17:32

General

  • Target

    8cac8bc1a9e15d852aaf2d0ee8c7b348_JaffaCakes118.exe

  • Size

    968KB

  • MD5

    8cac8bc1a9e15d852aaf2d0ee8c7b348

  • SHA1

    2b3c4836f923d26c95b829744bced8986705a9fc

  • SHA256

    b1d18e4c8a13d4bfec0a6b6fb170b0775bcc1447fdf8a9c6e30a37a66f1a8f5f

  • SHA512

    ae0c9b51e74377032ed9de7ee51fbf2dc0785b76f92046cf0ec7f2c5debfffc5d85e6b70bb3614c8a48f580588f0b2e473e318bdb6e3ad1ee2ab18b63d534d93

  • SSDEEP

    24576:vU8zsx/SWlMdF8Glj/y7tYoraDo/ZlaXBT3Wg30VALw+7:ExRlMdaszTzkaF3LEV/+7

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8cac8bc1a9e15d852aaf2d0ee8c7b348_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8cac8bc1a9e15d852aaf2d0ee8c7b348_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\8cac8bc1a9e15d852aaf2d0ee8c7b348_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\8cac8bc1a9e15d852aaf2d0ee8c7b348_JaffaCakes118.exe
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Windows\HFJEJY\AVT.exe
        "C:\Windows\HFJEJY\AVT.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2260
      • C:\Users\Admin\AppData\Local\Temp\write.exe
        "C:\Users\Admin\AppData\Local\Temp\write.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Program Files\Windows NT\Accessories\wordpad.exe
          "C:\Program Files\Windows NT\Accessories\wordpad.exe"
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\HFJEJY\AVT.002

    Filesize

    43KB

    MD5

    93df156c4bd9d7341f4c4a4847616a69

    SHA1

    c7663b32c3c8e247bc16b51aff87b45484652dc1

    SHA256

    e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e

    SHA512

    ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35

  • C:\Windows\HFJEJY\AVT.004

    Filesize

    1KB

    MD5

    bdb17b0525b1de51978b4e45fbb2211f

    SHA1

    c310e088fd2d9bf1c155a5a5bb84a636317988a8

    SHA256

    33d3d56f35f1d07c42059cebb12a70af3dbf3828351a0704f14b6ad695d6a0a3

    SHA512

    1b0f4371b8712aea1b6871a4c9492434431d3acdcb22003d4b34d43631182a2f1fbc1a0cdfa51cf828686f2c7b72d3e213fd44e123ef6a86f8c77f5d571ed959

  • \Users\Admin\AppData\Local\Temp\write.exe

    Filesize

    10KB

    MD5

    f8ed3b4b209e2cb49028e36cf06ca851

    SHA1

    71e0c405d0e615d55367df1bce4ceb19b3937a5c

    SHA256

    e46620bd4eb048fcb2a8f1541d2dbda8299e38e01a4eef9c4e7c3c43b96d0629

    SHA512

    87563891548b0eae7b410ad0877713216ed43c9160814a8bd14bc895eb8fafe2ab807d7666cf08e4882d8df2d46449d46bb347afe3bdcdb8034e533e135138b2

  • \Windows\HFJEJY\AVT.001

    Filesize

    61KB

    MD5

    383d5f5d4240d590e7dec3f7312a4ac7

    SHA1

    f6bcade8d37afb80cf52a89b3e84683f4643fbce

    SHA256

    7e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422

    SHA512

    e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a

  • \Windows\HFJEJY\AVT.exe

    Filesize

    1.7MB

    MD5

    3cd29c0df98a7aeb69a9692843ca3edb

    SHA1

    7c86aea093f1979d18901bd1b89a2b02a60ac3e2

    SHA256

    5a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32

    SHA512

    e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9

  • memory/2260-44-0x0000000000400000-0x00000000005B3000-memory.dmp

    Filesize

    1.7MB

  • memory/2260-34-0x0000000000400000-0x00000000005B3000-memory.dmp

    Filesize

    1.7MB

  • memory/2536-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2536-6-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-22-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-8-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-10-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-12-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-2-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-18-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-16-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-43-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB

  • memory/2536-4-0x0000000000400000-0x00000000004ED000-memory.dmp

    Filesize

    948KB