Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-11-2024 09:44
General
-
Target
abe12539eb925c14706dcdd910b213c2_JaffaCakes118.exe
-
Size
702KB
-
MD5
abe12539eb925c14706dcdd910b213c2
-
SHA1
80e045beff01ca43ee33aeed6e9cd8332bafeea5
-
SHA256
5e33b40c87958c4419cdbfbada2139df35c4cd74fbdcf8f66ee5ec40790429a0
-
SHA512
b70199e7b3b128005802bf4cfb50b005bd539f3d8694d18fa1d2c455be9a7fae96e9f77e228aa0ba406d1ac4883b354578727e6e6cebeda4b729e0ec491f2f21
-
SSDEEP
12288:S0KOUxpcOoZetp6HZK/FmVtpedrTmA9vuvHj5SM6Sh5vHfzpW4HZ6FylI:Bypc5oNmQdPmA92vHjc9S/v7pW+mkI
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 6 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\abe12539eb925c14706dcdd910b213c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\abe12539eb925c14706dcdd910b213c2_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Sys\NXLJ.exe"C:\Windows\system32\Sys\NXLJ.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\crackerelgrande14505.exe"C:\Users\Admin\AppData\Local\Temp\crackerelgrande14505.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5b429300c8148810d2e6a8d40009fc124
SHA193ec9660cc0d68cadc6c7f44b35ea0a0ef684ae8
SHA25698445d51b61014815fc43e44933e5dc126c4fe763545141e78ee1358e487b4b7
SHA51247a1cfdba6c1e04a322116538a62b22d61cf6b31966e53cfe4e54eb75a58530a7636e3deffcfb7e96ff2bdae2b99c7bcb312685d1ceac2f79c118f6347bf2407
-
Filesize
534KB
MD59be15f67eb0b2ebf7aa93afea86e4ba2
SHA1b887fac7cfc1f8911b7174ae0848be83c3a8dfbb
SHA25626550f0b37c019ab3ba5fd572d9bdbd44491c26ee564e44e0606aace7a793426
SHA51287a7e7b3a9677eb3f583d86f5881097a6967121d57eb84e961e63fca4524c4091bde94b75b2fb8214c4600d5c01585e20da84e1d52fe0fb63ae416d76aef5f5b
-
Filesize
304KB
MD54110952edcfd2759acc7e617d898bb80
SHA1fed4804ed5573b7f73da8e910c1c06ea8688f33d
SHA2566b2e6bbb4a3631f3697126867be69b9058068dc91118ef510d2d043981b67785
SHA5121943588cc2e0ebaf9abf3a56375f9c99af7fba10a9ab59bced6dfd945be23d21a789353ad4ae289f280345fd0d5f159a56aeefd27602c3d993e6161068f4c3c1
-
Filesize
387KB
MD5bcf6fab667525797024d0962e41e9b7b
SHA186b3d41b65eb4ed85c6610a4bb595df787bb2a6a
SHA256916385eb000bc6011cac9b11d89fd08ffaaddf7d727f9c9bf0764bbcf905b877
SHA5127e04832d129e3bacb4d4d83259ec02e1e6f5da4da742dbbf010345ccd90a0547e12fcca68da3cff284687a112f570ca269596512605715b3477ae99933afc82c
-
Filesize
3KB
MD5aa4f77715add7cc635a8f8c16849dcc2
SHA143b3f0de95c0e651ecb6a444dbb8971c1a4742ff
SHA25642555778b45b9c6c4b568993658e4d2449db269956ef0d009ca9807581ed8e77
SHA512508138b8d9976e3da9e1354321a585d0eca5319b0fdcaf763da1d8af0b44ac49385d414d14826e79b7d3dd033c0d011b2eb7caf4be72c458cbb866662d142e83
-
Filesize
5KB
MD53a2ef41ad6d9415229e0b76ec6df1baf
SHA1e72f2c0d664a4d2323872bd1f586ec60bb0a6342
SHA256b7e321cf9dacead275e600c2b531e96a62c671e0a2d641e141acbefb509adf2b
SHA512b8d5f62e7da21d4114f8764afb16bc409921935d3440f8e712740a50dd7a01f850cfda31f0a4b41e4f514d6bb64e407a83e8e034e5be65cddde27817c728caeb
-
Filesize
4KB
MD5cb576a1e67ddeb42dc0e23a541cefdb8
SHA19684e67a013de4f0f5066856f553674db0f2749c
SHA2568a9a4e62b646f072f6c1b5415b8461af96db307f59c4d32c9e4f455477ffc221
SHA512e173475fbf9541daa6790133ceef4b8af414491c0a198e356ba1b1c2fcbdcf7044e8b8ae22d72f39b2b7b888e254fd742b9b09ae3c4e63fa64b5171508247942
-
Filesize
468KB
MD54b64ea8b01e25e1af067d11698778ce4
SHA120c4d03590cc3ef10e0b3ddbfcdf6fbb41149847
SHA25608b9f18c1098036ae8830caae054c451c66478490dcd4c653a01abaa937ee7c5
SHA5125bea198540fa4dd9234017ec3e7a0cf79da4d3bc53cb715a3a6335567c08ff0871b886d6f4dd80e9f4e9df4cac8be392fc7d0e3456c14624583c6cf337ce65d0
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
84KB
-
Filesize
84KB