Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 22:15
General
-
Target
d3ddc23a214ce0d4bb904f37b71e5796_JaffaCakes118.exe
-
Size
3.7MB
-
MD5
d3ddc23a214ce0d4bb904f37b71e5796
-
SHA1
7d3bc6263d692d02eaca0179b180e7c687d456c0
-
SHA256
9ec7f27e0a011b3eb0059ec661f84ec945240e018542d864456a3236c2eba42b
-
SHA512
d8b4dd40a665ed49c2662a9e8b697bcaee0fbbd4fdab13f71324034a50e956ddf316bf494491bba5d8846652f2c487666dce3732083017ec01804a01604d29e6
-
SSDEEP
49152:VRToFtuJ2dRjHLbgTHgfHKDshE3qt+Yeon8BfkIoXhO/8ckA7U7BkQkNygU2Zgd2:tKHLcT7YhE3quBu9hDp8UTkcWBm2
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3ddc23a214ce0d4bb904f37b71e5796_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d3ddc23a214ce0d4bb904f37b71e5796_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\UBGYXF\TGN.exe"C:\Windows\system32\UBGYXF\TGN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\08-Adagio 8.mp3"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5befce8cabc682d0cdd2be9f5bb5c69f1
SHA1998ea82df850b63648af13637f99f59a1cd9e91b
SHA256cbdfef80bfb17f1361cbe6680a096fa03a0f5dd6dd99871d311646db98a41572
SHA512c61ae1b0915e235efcc624d31379c5af1fea259db50771c5bd6545e0e8119e75d34c0a8ddf59eefe6c4eaa397a9be62a1fee7bb5755c3af916c6b3b4197b8c7e
-
Filesize
465KB
MD54061e424a7e62d613aa16201364593c9
SHA184e5f41196523eddd24b62670ec8100632dbc933
SHA256d39b682a1de3541ce4858727a3206a0fb78d1e070e4dd60fab43c2537d1adfd9
SHA5123290348c02db1d9125d80b6e240544d51b0805240e113397d85a3fbdf3421172c8dd23e5631525db9258b7eedcdc228df3082041a017c664593eac698773f5fa
-
Filesize
61KB
MD54eb04b9187bbf3e3c33bf95e74eb6262
SHA1ca5dcaea5ef4ba48c0bb06635c0b5abed4f0f342
SHA256cf84d5704b350beaf1f2b46dc44bd372141d7554a8958ce22c0a84a3f21f2fe7
SHA512aeaa608cd4f66ba817a7e8698d17f9801c9cedf99875decff39bc18cebdec3947f02566bdf21d9096e5a6a6b740717ab06d46a2a9605bf8e8fa0fee12fe17e81
-
Filesize
43KB
MD51aed6fee0870288cdb607393fc2f33a1
SHA1584fd8d5ffbced19dd09b8b71cee9026c0ac65c6
SHA25602c4eef7045896258d00077e123719aa256c606f4e38c417965ba5f64d48e180
SHA51215e5b7843b07bcb4a638057b05712c66b285d70ace24ab3a4c125d24d538ace20cfac179accefa417d7790f7a095327affd3cd73d9eacaa632356f95a9fde3b8
-
Filesize
1KB
MD5ee9ba69eaf09928ee53d1763786adac1
SHA1a041413506ba22a94d6c0bffb94f51c56890843e
SHA256a42c1cd0e59f57d2eeaaf1c8dd9531fe536e2be39f28634f7f168c707c87e08f
SHA512d6d089dd3e7fbe2431fbbca9bb28dbd45592ab5447cd0ad4565ce5a93acf8ffa997b2e78025613a34497118c3a7a6668db7655a3b5a4c7099d0123deb0453d15
-
Filesize
1.5MB
MD5865b02aa4fb68ac150953986e6f63f1c
SHA1214190642d67f02c349e68f3f3c6ef0e9c2212d7
SHA256fac58547e80a1b9598261b6d2aa5175653831e507c57b6860bc5d04d2e754dff
SHA512473dc55a8a8f11d8445cef9cd8cabf8a9b227a6e47994ecfe9c86d41062641668d858e61b7ade1ad2801c5daa13d0630159b7ad241379e111c83564030c0a40e
-
Filesize
16.7MB
-
Filesize
392KB
-
Filesize
208KB
-
Filesize
992KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
116KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
2.0MB
-
Filesize
260KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
1.5MB
-
Filesize
2.7MB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
436KB
-
Filesize
132KB
-
Filesize
264KB
-
Filesize
88KB
-
Filesize
160KB
-
Filesize
348KB
-
Filesize
788KB
-
Filesize
76KB
-
Filesize
188KB
-
Filesize
348KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
496KB
-
Filesize
412KB
-
Filesize
192KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
4KB