Analysis

  • max time kernel
    94s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2024 07:50

General

  • Target

    a6bc1efc599844ffad0f09f8d8c362f5_JaffaCakes118.exe

  • Size

    980KB

  • MD5

    a6bc1efc599844ffad0f09f8d8c362f5

  • SHA1

    f3e349a40881bb546c5f64257c04869b61bdf369

  • SHA256

    f0a9c89d638fa825784321c357739d4ff39660629006f0fcf33c11a029d45fcb

  • SHA512

    f191026a471fb8b394f31a75479269df7006f1ca09fd5f85aa81fa30bf875f39a4570291a2cf23c5add1d6ad8fcde4a18976695095fb204f8fe9281ef709a0c4

  • SSDEEP

    24576:fiBAC55W62AAd2zCE+m1G68yf21H9r+hT/WLZK:fyAC55N2H7E+OG6Hfor+hoK

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6bc1efc599844ffad0f09f8d8c362f5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a6bc1efc599844ffad0f09f8d8c362f5_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3712
    • C:\Windows\SysWOW64\Sys32\EMTU.exe
      "C:\Windows\system32\Sys32\EMTU.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1512
    • C:\Users\Admin\AppData\Local\Temp\Trainer.exe
      "C:\Users\Admin\AppData\Local\Temp\Trainer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\@B16E.tmp

    Filesize

    3KB

    MD5

    2faa832b62991d302b56093477a76363

    SHA1

    2a26e0173a78c9c106ea799cce92ea163b44a345

    SHA256

    a2076664d1267efa8b69a307b0cbde8521631f2789e06f5caa96799e7f34de48

    SHA512

    20da18fb1350a441517498a1efeae9a21ead7592f9cdae724973c58385765100a2de5651fa991cdcc4668be777fe26bfba969dbc9706f16a54f5be258a84f347

  • C:\Users\Admin\AppData\Local\Temp\Trainer.exe

    Filesize

    548KB

    MD5

    e856630ec50668e73217aca4b23660e9

    SHA1

    b71d7b3bd6abd21ac327047573bd1540eb78faf2

    SHA256

    3974f8e2684689df32aaedc10b8797a4f53c66ddd17e6ef536d258580481f306

    SHA512

    808eb633263c88e7e35103e6734bfe2b7369bd0fb7c2bcb9c862dabf9d53d450bf22dd07fb91365f2d6438d6a3443a0d8feef63025a483c5908dcf3eefa89560

  • C:\Windows\SysWOW64\Sys32\AKV.exe

    Filesize

    389KB

    MD5

    0a4d2002c7355a6c0d8e846fe02e7e89

    SHA1

    cc1bf70d3d718d3d3dc1b43405d36285933feac7

    SHA256

    be2cc3bda4c0e231ebae65a7c79ed1313d422e5fb2f871330080f8ca1792e455

    SHA512

    9e229232bbc8e4faa0ea63e1069000c2e1582a5d7b72abb5535b003d339a0984b08a34a86b36e17dad61277f0456fe98fab2dbcd2db493feee927892ef7cba57

  • C:\Windows\SysWOW64\Sys32\EMTU.001

    Filesize

    460B

    MD5

    90a989a987ecc546f168b988db941c10

    SHA1

    cd87700b8a4e071fdb32e8e817d9f9216a6868cb

    SHA256

    f08080c8190b71f637ddb19289c1d10be7a0d1b2444f84eac09fbb3904c57746

    SHA512

    d945aace2bc064ddb41834f7206445c7ed01884c1a57b4df19a633807dfb7cb0dc8ed20247231b194791c839202887366c453f17335d68a173dbbdd1f8393c60

  • C:\Windows\SysWOW64\Sys32\EMTU.006

    Filesize

    7KB

    MD5

    8013928e1446be1b8e77ca35211fd17e

    SHA1

    c03a6c0516d1763bacc4da535383d3b4ddb506c3

    SHA256

    d82bb0b7a29a9500a79e52b2ea84ea244f250cc7ff25174aa4ed5826d6b9c828

    SHA512

    d5e55bb8dda7f44918bafb16098d39e363237053f84377d5d591d9010b0f14a6eb2260f9dd356e32e133ab2a42c1debed0424fbe7de932d8d363ac8a09a7660f

  • C:\Windows\SysWOW64\Sys32\EMTU.007

    Filesize

    5KB

    MD5

    bb3520f108916b0967e74a9167b44925

    SHA1

    29dd637355ec7d38955af75775a72ac32903d40c

    SHA256

    f9be7b7c760a59f4d98213f4f80d45e405d1d0ac564d4f880ec820da178d45e5

    SHA512

    7700bf7e8fd15df753bc83b8e243e4b62095824b8bea3f40d7213a5c6307f17d9fbab2f6c737e19ede5330539014ba6c583b25bd2d58b05f05f23683affe1d53

  • C:\Windows\SysWOW64\Sys32\EMTU.exe

    Filesize

    475KB

    MD5

    3d9eaf31ec5138624f1cf21706264bd6

    SHA1

    f2c397f042c38862034333ed3c142a54896e0305

    SHA256

    17c47ecc3481cb85c0336e7bd58f141f54fa1bbe604892c41d3e6a1945b43811

    SHA512

    a849c329950bb015cc32624968c39c9f3f70fb37500e0292bbccb79a6413d4088d68d481e3c8c2ac0b8975b885387abe581d597892d906e357ac573c3525ed9e

  • memory/1512-35-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/1512-41-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB