Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-11-2024 21:18
Static task
static1
Behavioral task
behavioral1
Sample
a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
a9ae730252e8e713170cb30f386dc430
-
SHA1
e2124e98a9fb772d04b9559e4917d736ecdf1c66
-
SHA256
c9c519b8f31c2f7dd5ee4207d63edca332d137b909ae0c8bd0ff4305f6d6e6e4
-
SHA512
c34630b9e83bce705c60a68a2ebeffb5a5e5cbd167d6a5219e80dc7229ed3d508902aa7b6a3a4d8b8dd1ebe3ee6da457de6572e317bbe7b799394e821ffee0d3
-
SSDEEP
24576:cPbLngpiA02WqLP43Hpp5P+9wRWikz+tMhe6kRFpbV3DFu3:62cqLP4XDMwcikz++he6KvBm
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0005000000018697-72.dat family_ardamax -
Executes dropped EXE 4 IoCs
pid Process 480 New AutoIt v3 Script (2).exe 2932 New AutoIt v3 Script (2).exe 1668 server.exe 3008 PHXR.exe -
Loads dropped DLL 13 IoCs
pid Process 2612 a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe 2612 a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe 2612 a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe 480 New AutoIt v3 Script (2).exe 2932 New AutoIt v3 Script (2).exe 2932 New AutoIt v3 Script (2).exe 1668 server.exe 1668 server.exe 1668 server.exe 3008 PHXR.exe 1948 NOTEPAD.EXE 3008 PHXR.exe 1948 NOTEPAD.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PHXR Agent = "C:\\Windows\\SysWOW64\\28463\\PHXR.exe" PHXR.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2932-43-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral1/memory/2932-45-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral1/memory/2932-44-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral1/memory/2932-42-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe behavioral1/memory/2932-62-0x0000000000400000-0x0000000000498000-memory.dmp autoit_exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\aplib.dll a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\PHXR.001 server.exe File created C:\Windows\SysWOW64\28463\PHXR.006 server.exe File created C:\Windows\SysWOW64\28463\PHXR.007 server.exe File created C:\Windows\SysWOW64\28463\PHXR.exe server.exe File created C:\Windows\SysWOW64\28463\AKV.exe server.exe File opened for modification C:\Windows\SysWOW64\28463 PHXR.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 480 set thread context of 2932 480 New AutoIt v3 Script (2).exe 32 -
resource yara_rule behavioral1/memory/2932-31-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-28-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-25-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-43-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-45-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-44-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-42-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-41-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-40-0x0000000000400000-0x0000000000498000-memory.dmp upx behavioral1/memory/2932-62-0x0000000000400000-0x0000000000498000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New AutoIt v3 Script (2).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New AutoIt v3 Script (2).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHXR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1948 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3008 PHXR.exe Token: SeIncBasePriorityPrivilege 3008 PHXR.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2612 a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe 3008 PHXR.exe 3008 PHXR.exe 3008 PHXR.exe 3008 PHXR.exe 3008 PHXR.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2612 wrote to memory of 480 2612 a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe 31 PID 2612 wrote to memory of 480 2612 a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe 31 PID 2612 wrote to memory of 480 2612 a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe 31 PID 2612 wrote to memory of 480 2612 a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe 31 PID 480 wrote to memory of 2932 480 New AutoIt v3 Script (2).exe 32 PID 480 wrote to memory of 2932 480 New AutoIt v3 Script (2).exe 32 PID 480 wrote to memory of 2932 480 New AutoIt v3 Script (2).exe 32 PID 480 wrote to memory of 2932 480 New AutoIt v3 Script (2).exe 32 PID 480 wrote to memory of 2932 480 New AutoIt v3 Script (2).exe 32 PID 480 wrote to memory of 2932 480 New AutoIt v3 Script (2).exe 32 PID 480 wrote to memory of 2932 480 New AutoIt v3 Script (2).exe 32 PID 480 wrote to memory of 2932 480 New AutoIt v3 Script (2).exe 32 PID 2932 wrote to memory of 1668 2932 New AutoIt v3 Script (2).exe 33 PID 2932 wrote to memory of 1668 2932 New AutoIt v3 Script (2).exe 33 PID 2932 wrote to memory of 1668 2932 New AutoIt v3 Script (2).exe 33 PID 2932 wrote to memory of 1668 2932 New AutoIt v3 Script (2).exe 33 PID 1668 wrote to memory of 3008 1668 server.exe 34 PID 1668 wrote to memory of 3008 1668 server.exe 34 PID 1668 wrote to memory of 3008 1668 server.exe 34 PID 1668 wrote to memory of 3008 1668 server.exe 34 PID 1668 wrote to memory of 1948 1668 server.exe 35 PID 1668 wrote to memory of 1948 1668 server.exe 35 PID 1668 wrote to memory of 1948 1668 server.exe 35 PID 1668 wrote to memory of 1948 1668 server.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a9ae730252e8e713170cb30f386dc430_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\New AutoIt v3 Script (2).exe"C:\Users\Admin\AppData\Local\Temp\New AutoIt v3 Script (2).exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\New AutoIt v3 Script (2).exe"C:\Users\Admin\AppData\Local\Temp\New AutoIt v3 Script (2).exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\server.exeC:\Users\Admin\AppData\Local\Temp/server.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\28463\PHXR.exe"C:\Windows\system32\28463\PHXR.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3008
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\CREDITS.txt5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:1948
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a7297286016eb1ed500f4af219816b6d
SHA1da9d08c9c6e20a7778684145d90d279858f71040
SHA2563d6b01722af24324fa9a478fe0b7a24dd6736c06c89b3d28de12ddb3a4762d4a
SHA51281d76f15fa18fb663a5f61ae1e6629ad159bb4330cde224285b4432a3a7fad5d419d24e4c14710261e85ae292a6c77008336fb68d18622e95261532772e5f74e
-
Filesize
504KB
MD515b3ae2f7c989ba86a6f336b9dd3fe9e
SHA100df30f610fb3f2c18622864a562eddfc488de2e
SHA256d52debf5e2636a18a3991b790629f2e8f6291093170f5f79a54b388df21d39c8
SHA5128823c7b64cdab45dba7e0ffbeea499634e298970f9ecee78ca7cb926a8a71529cf609044be52b3556d9df50b7a6fe35b81c14bd2bfb73996e4e157ac68f574a1
-
Filesize
395KB
MD5b8fa30233794772b8b76b4b1d91c7321
SHA10cf9561be2528944285e536f41d502be24c3aa87
SHA25614116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
SHA51210ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
-
Filesize
482B
MD56ccb62969f53c86aaf700e613b54e4b1
SHA13d3e659e133e7b2cf13cd1b17fc2528e69d2a5f7
SHA256ba2f36541e8dcec8dcaa140e25fdcc6ee62c6b4d256b6a4344f47a0aeafcb69f
SHA5122e43512a66359c351c8e407296a6e8d85b30f4816e4127d5743c1e43683b0b5a560d0f4c0ecdb97fc578669bdb06690772520568f9667d67a8d262dbffacb3d9
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
1.3MB
MD5d46c688786cef7259b58434e0a82b726
SHA1b28efa5db999bda71e047941750e0af63f720417
SHA256ef371b0f55e051e7498a321d53bd75d61465068ef8383180538e00ff627846b3
SHA512c2e685b4ec6bd83169426af3db0aff8eabdb22e4e725b34922600bda2ae05cca39deaadbc361af5f099b05e444f238dc368409b8cbf09b5900e64de28f016778
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8
-
Filesize
12KB
MD535d174edd3c0bcfa9a32dce19e1abeb9
SHA1c22638e64f8a5f34809811a2c286ae2f115028f8
SHA25634194aa58d0eb70b513ea6a876a4f35ba6cc2f19c4fb6d408dd05580dcc74b04
SHA512f807df3655e6dd0cea2412ae82aa7b3babe3862fa9eee5d38673ee30b26a528b9618e1a25d3a58ef1ff14be36a666fabd32968b5f4dc481539d2372b526c1ead