Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2024 00:14

General

  • Target

    bad745f177f89f4013b079c0178eab62_JaffaCakes118.exe

  • Size

    789KB

  • MD5

    bad745f177f89f4013b079c0178eab62

  • SHA1

    0e724b22d574f11008170a4e4c3767ca01a17922

  • SHA256

    e2e50c459c2bf682f4aa695dfd1d531753ea9f3b25368227f9f5e954708634c2

  • SHA512

    6c0bdc5451cdbd6476bcd52d216ab4356a24ef62d2f9c3fe83ba13dfd132973aebe5862c524a3bd5e602b8d82920ea886fdc4ba875fcebafdf737f4d1700d22e

  • SSDEEP

    24576:du0UDwcQqxpEjIO3ddsHQXCqJTBCnQGatpxz:durccO5pJTB/Rpxz

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bad745f177f89f4013b079c0178eab62_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bad745f177f89f4013b079c0178eab62_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Windows\SysWOW64\28463\LHTO.exe
      "C:\Windows\system32\28463\LHTO.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2772
    • C:\Users\Admin\AppData\Local\Temp\Voice Activated.exe
      "C:\Users\Admin\AppData\Local\Temp\Voice Activated.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\@9A0D.tmp

    Filesize

    4KB

    MD5

    d73d89b1ea433724795b3d2b524f596c

    SHA1

    213514f48ece9f074266b122ee2d06e842871c8c

    SHA256

    8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

    SHA512

    8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

  • C:\Users\Admin\AppData\Local\Temp\Voice Activated.exe

    Filesize

    20KB

    MD5

    4f4a924b2572d6368d5846430df22158

    SHA1

    c304833fc8f8f8de3ec0b77851c89eea8cf34f32

    SHA256

    767d211784af62386b3d00f28ccfb649c64daed5c6e7a80f6615d556e3ad1064

    SHA512

    69c06da1ce718c195f70262c4eaa528cb1feac0bc51fc9ad1b60b7f6e405ab9a3034fe23c908b2f5176df56b6f2a1c2d40082ff40b13d6defc594e5efe26db5d

  • C:\Windows\SysWOW64\28463\AKV.exe

    Filesize

    457KB

    MD5

    97eee85d1aebf93d5d9400cb4e9c771b

    SHA1

    26fa2bf5fce2d86b891ac0741a6999bff31397de

    SHA256

    30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

    SHA512

    8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

  • C:\Windows\SysWOW64\28463\LHTO.001

    Filesize

    440B

    MD5

    53cc9a3780e82e0ca818108c241d5380

    SHA1

    cba1bcb8bca0f593eb1f3686611fdc542dc945ec

    SHA256

    60b2094ef7627c8bc09e131ef03bfcc8f250b7b3bfb8035106dbd3fd174ba29b

    SHA512

    7fcd304776f82f905650d2e17bacc1f5b27cfeacc6c38827a64617a25715d761ca602a54ce9bf80def0f455420caf0beb45f82da003ea798ee9d2ae63e228bf6

  • C:\Windows\SysWOW64\28463\LHTO.006

    Filesize

    8KB

    MD5

    35b24c473bdcdb4411e326c6c437e8ed

    SHA1

    ec1055365bc2a66e52de2d66d24d742863c1ce3d

    SHA256

    4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

    SHA512

    32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

  • C:\Windows\SysWOW64\28463\LHTO.007

    Filesize

    5KB

    MD5

    a8e19de6669e831956049685225058a8

    SHA1

    6d2546d49d92b18591ad4fedbc92626686e7e979

    SHA256

    34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

    SHA512

    5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

  • C:\Windows\SysWOW64\28463\LHTO.exe

    Filesize

    646KB

    MD5

    b863a9ac3bcdcde2fd7408944d5bf976

    SHA1

    4bd106cd9aefdf2b51f91079760855e04f73f3b0

    SHA256

    0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

    SHA512

    4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

  • C:\Windows\SysWOW64\28463\key.bin

    Filesize

    105B

    MD5

    27c90d4d9b049f4cd00f32ed1d2e5baf

    SHA1

    338a3ea8f1e929d8916ece9b6e91e697eb562550

    SHA256

    172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb

    SHA512

    d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae

  • memory/2772-36-0x0000000003210000-0x0000000003213000-memory.dmp

    Filesize

    12KB

  • memory/2772-49-0x0000000003230000-0x0000000003231000-memory.dmp

    Filesize

    4KB

  • memory/2772-33-0x00000000023E0000-0x00000000023E1000-memory.dmp

    Filesize

    4KB

  • memory/2772-32-0x0000000002420000-0x0000000002421000-memory.dmp

    Filesize

    4KB

  • memory/2772-31-0x0000000002400000-0x0000000002401000-memory.dmp

    Filesize

    4KB

  • memory/2772-30-0x0000000002410000-0x0000000002411000-memory.dmp

    Filesize

    4KB

  • memory/2772-29-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/2772-35-0x0000000003220000-0x0000000003221000-memory.dmp

    Filesize

    4KB

  • memory/2772-20-0x00000000009E0000-0x0000000000A3A000-memory.dmp

    Filesize

    360KB

  • memory/2772-48-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/2772-50-0x0000000003270000-0x0000000003271000-memory.dmp

    Filesize

    4KB

  • memory/2772-34-0x00000000023A0000-0x00000000023A1000-memory.dmp

    Filesize

    4KB

  • memory/2772-47-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

  • memory/2772-37-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2772-38-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2772-39-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2772-19-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2772-58-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB

  • memory/2772-59-0x00000000009E0000-0x0000000000A3A000-memory.dmp

    Filesize

    360KB

  • memory/2772-60-0x0000000003260000-0x0000000003261000-memory.dmp

    Filesize

    4KB

  • memory/2772-64-0x0000000000400000-0x00000000004DF000-memory.dmp

    Filesize

    892KB