Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 12:39
Static task
static1
Behavioral task
behavioral1
Sample
9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
General
-
Target
9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe
-
Size
787KB
-
MD5
9b8a00483a9fe819e5dcce16aec378ec
-
SHA1
deda07550438a64ee41fe709a8d8e6ff15446818
-
SHA256
0ebebd986c010922af108e86dad6ffbce1d2957d9313dd240bd6c3222571beb7
-
SHA512
e65301a6a88d40b8e665f30bbff9ceea4c1bfbb8a11ef679480ff6a46f8ef9c237d966c9abc9ab6054c956eec4d36e20e024376c1476feffc04b203c7c833cc2
-
SSDEEP
24576:wkvP+00dxNTTLnNdgrr67mwxHPAPc8Ghm5w:wK+0eZTLwrrALvAU8t6
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0009000000015d1a-9.dat family_ardamax -
Executes dropped EXE 2 IoCs
pid Process 2388 PHPJ.exe 1328 Dard.exe -
Loads dropped DLL 8 IoCs
pid Process 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 2388 PHPJ.exe 1328 Dard.exe 2388 PHPJ.exe 1328 Dard.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PHPJ Agent = "C:\\Windows\\SysWOW64\\28463\\PHPJ.exe" PHPJ.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1328-40-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-51-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-72-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-83-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-104-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-125-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-136-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-157-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-168-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-189-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-200-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-221-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-242-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-253-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe behavioral1/memory/1328-274-0x0000000000400000-0x0000000000497000-memory.dmp autoit_exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\PHPJ.006 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\PHPJ.007 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\PHPJ.exe 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AKV.exe 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 PHPJ.exe File opened for modification C:\Windows\SysWOW64\28463\AFK_WeaponChanger_Config.ini Dard.exe File created C:\Windows\SysWOW64\28463\PHPJ.001 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe -
resource yara_rule behavioral1/files/0x0007000000016c4a-19.dat upx behavioral1/memory/1328-32-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/2380-29-0x0000000002A00000-0x0000000002A97000-memory.dmp upx behavioral1/memory/1328-40-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-51-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-72-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-83-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-104-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-125-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-136-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-157-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-168-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-189-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-200-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-221-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-242-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-253-0x0000000000400000-0x0000000000497000-memory.dmp upx behavioral1/memory/1328-274-0x0000000000400000-0x0000000000497000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dard.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1328 Dard.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2388 PHPJ.exe Token: SeIncBasePriorityPrivilege 2388 PHPJ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe 1328 Dard.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2388 PHPJ.exe 2388 PHPJ.exe 2388 PHPJ.exe 2388 PHPJ.exe 2388 PHPJ.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2388 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2388 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2388 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 30 PID 2380 wrote to memory of 2388 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 30 PID 2380 wrote to memory of 1328 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 31 PID 2380 wrote to memory of 1328 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 31 PID 2380 wrote to memory of 1328 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 31 PID 2380 wrote to memory of 1328 2380 9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9b8a00483a9fe819e5dcce16aec378ec_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\28463\PHPJ.exe"C:\Windows\system32\28463\PHPJ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\Dard.exe"C:\Users\Admin\AppData\Local\Temp\Dard.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD5d4ede8e7ff82ce28b333882c9ec76060
SHA14531c68a7400bbe3a17109a799363cb43bfce7ee
SHA256e4ddf928e6ab134e90f8e4c4e9c95bf4976ea252d69a6cae1778bfc419f599f5
SHA5127b258b0817bd5fdc715b5b695cc85eba8d0a7cca9ba63e707a8d2169b7cfd40059f5a93d3671e5f347993986e892fba7a73a81da1b992f41a3235c2445f9074f
-
Filesize
393KB
MD5b0b09699ea39c0107af1c0833f07c054
SHA1b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1
SHA256be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1
SHA51255430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796
-
Filesize
528B
MD51516d071987eca4cc790ea2434adfef9
SHA11bd7c807b0eab7788880ffba17cfa4a936f05c81
SHA2566865856a8d2bed40b21183f49ebb738fb3570b68f1c59e60d49dacdd54d3acf3
SHA5124a3dfc3484ced4d666ec92513e4ab2fa60f6f4ddb92f8bf3b1f5fb0e0d4c24b89f8ed50a4c878f0ceb4d9a31186d513937fc1cc087deb4ae90ea6fbc3d5f1b9c
-
Filesize
7KB
MD5e0fcfa7cad88d1a8a462cee6b06cf668
SHA1a7e49078517abc929a6da261df06556c8f5a8cf0
SHA256340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4
SHA512430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82
-
Filesize
5KB
MD5ca72cd485d116033f1b776903ce7ee0a
SHA185b0b73a75b0498f56200dd1a5cf0de5371e42a3
SHA256e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4
SHA5128dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f
-
Filesize
4KB
MD5908f7f4b0cf93759447afca95cd84aa6
SHA1d1903a49b211bcb4a460904019ee7441420aa961
SHA2563e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23
SHA512958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d
-
Filesize
290KB
MD5d8c756234628c145e545ea98a5f75c34
SHA186947cd2e37da68a0b3dce9aa2ccd4482caafeff
SHA25683ad39dcfea1217d5873596b1983ffd4ed198ebaab4cec3af8fd3718f48df553
SHA51223d4ff2cc83b513532f8db007534674ce6338087858051a3a9f7bb18cfbf0b6b188a1991734eb799c87aba54c7687cd119629ce4d02f5a6cbedc6829d1827bde
-
Filesize
472KB
MD5346114aaad81ab66017869909fe59a6d
SHA1770bdb6baa0d840485415da164020dead9336e27
SHA256766b515e04dc1894e3c7108bdc9e6e9a80652ebdf717fbb27b628fb5ec0ca056
SHA512b7bda8c0cea75fa9bde56d314e2a61b414fabde7df402cd5892dd149769f477209fcbfb7d05727952da4442e7a43578d1399f220f9d41f8b8cc9f4cd6d5ff954