Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-11-2024 03:49
General
-
Target
aeb56fe0e91582bf502e6ce21cc5be5b_JaffaCakes118.exe
-
Size
832KB
-
MD5
aeb56fe0e91582bf502e6ce21cc5be5b
-
SHA1
b2394be8100b5bbe11d5bd83f92b495c603fb188
-
SHA256
cf7b2b68f82c522af77792d163076ae55efa43f11b293a2a51cce59c4ba60e93
-
SHA512
dca167732348ce70b9ca4aa4aaeecb9fd2fb1ece9b80a612ecd601da99148df0124a366e2808db1e37f66b7499623bb148cf4ea1e183e63b82eef093727bc5ee
-
SSDEEP
24576:TNbuWqe4nJsNRkpNX7JCLmA3VDLywpfPh:0WqLqrkzVCLd3FLz3
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeb56fe0e91582bf502e6ce21cc5be5b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aeb56fe0e91582bf502e6ce21cc5be5b_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\X28.exeC:\Users\Admin\AppData\Local\Temp\X28.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\EFAK.exe"C:\Windows\system32\28463\EFAK.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5ccf39f70a662f70e7cae4cfc81255c44
SHA100177d41252c2a5322be8e54567a845217072e2c
SHA2564c9cca81f2f2d91b636c0ec747e96821749788368c48981bf04accfeb5c2e5d0
SHA5122cc006d3bd6af737f31707b457caaa267ee1361cfd0afab0be8b74be8587d02b20909962d138e137fe79252e0d112bd3be091a98ba50863520b5bbf21bb9501d
-
Filesize
785KB
MD59d52dbee2f408a105ff122730ede9cb7
SHA1602ad40a4c0ab9d53c515d8199c600ec24d3c493
SHA256632cffe2ae4edba93cd11bfb921b420ad8abf59fe3ad0a70f0522af6807560e3
SHA51259f99b1b4f8b3a316433c5855eb3be3b2eb00a229bfcb5d6d20ea0f106b76918e450bc733e0bae63028f075c99759c3bd818a7ed500b2867d2c45082b18cf8ed
-
Filesize
457KB
MD5828586f5f9fd7e6bd99401fe7cece954
SHA18eb70f4af2cec3c3dd3ec1491913369e99b7b874
SHA25602b8379b1838ea70f7f17e0785aaaedb7c721d9b6e262577723bba9492748d0c
SHA51216b64be59cf9ae403fb3b7e1fc8da98cb2a5db84aef0e352910172796ecf96dcf86a7e16afe78fa7e22b7b6948e8a1fa027da7161d5a0ad98e76175d764ed6a7
-
Filesize
510B
MD587ee8d6452097adf270b44337fb30727
SHA174a1ce5c2830b46039753cd9b534c9cd5556a9c3
SHA2560c4979aa6f1d56b2c51cc4250df791c5e058bc3c220cb1e3f85bdda2d3216af9
SHA512095354cd7cea15ad6f2d9968853682fc6f46faa91a96730ed1fb7f19da8a4e7a611dfa7ec2c0902cbc185e5a8162fe74ea1df4fbb8edf95fea02bc826e811360
-
Filesize
8KB
MD569db8c925f2dd8136d956a086ed1ee41
SHA19d0f653cc7ab881eb45fe93490a9c096f2dec6cf
SHA256984da5476c2c69a779bc99d0901569347cc605a36499e2284706cda3ed6e13f3
SHA512fa5cedd539dca3631511488aea8bcb7821db1d53452c1b61ee663cb5700bb9919b092593a7f5eb7a3c3a75f801b2980f817de4a66bf8aa51093ced4b30ffd068
-
Filesize
5KB
MD59e9da4c851850726c789bb4b94a41bb3
SHA11e2fd71f1d1a3ac15d3c820d8459635cd775cf24
SHA25694f6502a4e94de0301ae07befd63767a4de35d9b2d2d00687a3130e883ab1963
SHA5124c60e951056c5773d769a9c88245fc4a597949deb72a1a7546991488e85ffc4ff2a34840ad227595bcdc105cf187207721b57c457ac832ee0159dd0e1d9be063
-
Filesize
648KB
MD5c5ca2c96edc99cf9edf0f861d784209a
SHA16cb654b3eb20c85224a4849c4cc30012cabbdbaa
SHA2560ca27dfe22971bfb19c7f3d6fe03cd398816a88fc50943ba9821fa6b91be7807
SHA512aeb36bbbf68c7b733ddd856f8f0cdd9548ff597843a22611757c98f69a589035410fecfa692bb83c740823ddae6432d3be5cb66f4309a9d0f5fedeb7b017ff36
-
Filesize
106B
MD5639d75ab6799987dff4f0cf79fa70c76
SHA1be2678476d07f78bb81e8813c9ee2bfff7cc7efb
SHA256fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98
SHA5124b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
908KB
-
Filesize
908KB