Analysis
-
max time kernel
121s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2024 14:08
Static task
static1
Behavioral task
behavioral1
Sample
a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe
-
Size
899KB
-
MD5
a8342800e4558d5cffa84627bea5c12b
-
SHA1
3771e9d8933fd9e3e65b533f528c239031e603b8
-
SHA256
156591b9f7812e7210e21e81bb201a74eea43243cf33726f9d778eb29e7de881
-
SHA512
d4284a2c1fafcdde648541e1606ac2785812eac9a26a68d71e3183d2407f46d7b91bcc7da760563ca542ea0f30282710bd3cfe309c091149c72906299b3a1428
-
SSDEEP
24576:Mk/ATDbn6fjlV2wwggxe83DGes1kKA1Sl:VoTH6fjVLg4gV0
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023c84-7.dat family_ardamax -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1664 EEL.exe -
Loads dropped DLL 1 IoCs
pid Process 1664 EEL.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EEL Start = "C:\\Windows\\SysWOW64\\OJPDJD\\EEL.exe" EEL.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\OJPDJD\EEL.002 a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe File created C:\Windows\SysWOW64\OJPDJD\EEL.exe a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\OJPDJD\ EEL.exe File created C:\Windows\SysWOW64\OJPDJD\EEL.004 a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe File created C:\Windows\SysWOW64\OJPDJD\EEL.001 a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEL.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1664 EEL.exe Token: SeIncBasePriorityPrivilege 1664 EEL.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1664 EEL.exe 1664 EEL.exe 1664 EEL.exe 1664 EEL.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1664 1740 a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe 82 PID 1740 wrote to memory of 1664 1740 a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe 82 PID 1740 wrote to memory of 1664 1740 a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8342800e4558d5cffa84627bea5c12b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\OJPDJD\EEL.exe"C:\Windows\system32\OJPDJD\EEL.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5425ff37c76030ca0eb60321eedd4afdd
SHA17dde5e9ce5c4057d3db149f323fa43ed29d90e09
SHA25670b00b09ae76a7ecfd6680ab22df546b17826755087c069fc87d14895e1a4e24
SHA512ef5ff97c0d682b6155eff8f92dace1789cf01ca8bca55af1c1d0f2243b5e18bc12a657bb2bb12601b51ef9e1b942f02feb8462644da291fd1b2239c34ef2b59b
-
Filesize
43KB
MD512fb4f589942682a478b7c7881dfcba2
SHA1a3d490c6cda965708a1ff6a0dc4e88037e0d6336
SHA2564de0c277800ae36b85a11ed9765f732a73578d4dce053ff7179f96ab776fb60d
SHA512dd1c6a4ea5bc9698701ec941c4e90fe8dfb0993dc321edc052d1a80cc49bc46be665a85ec678876e698de60cda5dbf1d6279742a16d648f9d18e642a3ea33ddd
-
Filesize
1KB
MD5f1e4f30524d84c3607d5dc63b0adbffb
SHA1237e55988b9f97a94b32830959d1ecb96b72be2f
SHA2561ad059a46f6e8a2a0f1a6f4ea291dcb10e36aa905db1c6d7a865b9753e87383f
SHA512fcbc39bcbcb2b0a9795267d6c10484646480ecb280c947e6158ae36c29f67e4faef7deaf2ccf0671be778c410f2d92aeb8cd9e2fd9f4427f5d4bb92738397fa3
-
Filesize
1.5MB
MD5f8530f0dfe90c7c1e20239b0a7643041
SHA13e0208ab84b8444a69c8d62ad0b81c4186395802
SHA256734439c4049ae1a832b4cc5c8d227112106406945d1a7cbb355e11a3f5e356c4
SHA5125cb01517938789e006e00d69729ae7d73ad480f1ae17a80059bf81ee5d9cebb1263a35732c84f03d742684a650b116b13e6731ca80b0b9cdb3908e5588649399