Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 21:45
Static task
static1
Behavioral task
behavioral1
Sample
dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe
-
Size
500KB
-
MD5
dbaf7de1ec14195b8f631ce4355b45c3
-
SHA1
7c11710760b005e7faf2894587860b1316f29524
-
SHA256
7da562c405c458bd95bb84288281fe09af1ab507a0c03b9599d85ee396e45337
-
SHA512
3656334f99a7273f35553413c7f89aa5381dd20a749f1fe1e2cced3beca6a7f36a2944f2111fa672a6b224c154844cbd501059e47b58802c8b5a8739ad8bd018
-
SSDEEP
12288:+LjYl4eADZ6Qu6q6h0QZDKDpwB1k9o39dGmqjEkO:hqeoZ6Qb4Q6q1ZttQEkO
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral1/files/0x0007000000016d6d-9.dat family_ardamax -
Executes dropped EXE 1 IoCs
pid Process 2368 XBCF.exe -
Loads dropped DLL 3 IoCs
pid Process 2372 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe 2372 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe 2372 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XBCF Agent = "C:\\Windows\\SysWOW64\\28463\\XBCF.exe" XBCF.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\XBCF.007 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\XBCF.exe dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AKV.exe dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\XBCF.001 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\XBCF.006 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBCF.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2368 2372 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2368 2372 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2368 2372 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe 30 PID 2372 wrote to memory of 2368 2372 dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dbaf7de1ec14195b8f631ce4355b45c3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\28463\XBCF.exe"C:\Windows\system32\28463\XBCF.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD538defc8742dcd7b684e5ae1193e7e668
SHA15710271eb398f63f0f0b209c46460ff9665df9bb
SHA256b74a277270efc272bef1e264dc11289b7f13c651ac7640745df46bf6792c36d1
SHA51246cc4b677af570905ac0c36b4e85030a618cefd6e4eb4eb4fc850ad2df45c14233024f0aa655e28649212aa42bf74499a91a682750748f75132aa18d1464cb84
-
Filesize
434B
MD5446954f1acda46277843ebb51c2a074d
SHA1aa80cb78ea76bb1bacd91ad360aacbc7cbe477d8
SHA2560353c84af232840c5a4c4d159d8eb675c53aa0c006c32ecbae5113b6c736aaf9
SHA512a38986d993fe9f7857969be69e21fa9df0c8497d0eae874b4de4d214951694db19d26c85622551ffe1684d93a8a63ba8d0b1e41e84c2ce3ee5b695c1a614942c
-
Filesize
8KB
MD5e44628a2b8e2044ebb635eed3d5f79d9
SHA187120d6466ae60ea0df734c578f371c5c77acf3a
SHA2566742a87a0df8e620ff5314729c94cfaa738daf172220868cb748b09bb4e72ca4
SHA512ab1ec2ced331a14d60976338715cb9a09144b784d5c3fbcee139e85f843cab9aaa6627ae7a2f7f9d82cda5297fcc045e97385639397acb252bb18ebf315db37e
-
Filesize
5KB
MD575d6279af7fa9545ba7b7b01a85d2e12
SHA12fa39502b0aaa872712068747ff4f0800e955898
SHA256189a54410440caab60ed99dadf5fed2edcb0d36e5ed3e9a59be41026662bbc0e
SHA51226c21d6e68fef49d988d4e20da9df164760318087752d4d872275efdc0c667fc31426a916acb8eeb65a0acf20ce3bd3c8953bd34cd83cc46cf44c329469f2ae9
-
Filesize
4KB
MD5102f90f4f42551b2acd64923065a2b56
SHA118bbbd1a10b603e05816f5a2baf9a6bed74346a3
SHA256623f4b9a4910c8815d2ab19696668258ff2c30c3adac8967d616f7e60ec619fd
SHA5122c8338799bcd64083dbe8b0e763424962dd024c52996bae590500b7d844595b539549b6c239f68f3866d5fda9db10808e8e9b489031a1e942bc34277f9a1d9d3
-
Filesize
526KB
MD5c4e65cee2c8eaf4a4c03852192f49156
SHA17c7b416d08056e2ecf215a6ce7126cf74ca3d87e
SHA25695b5415e32ec93a15a060b6e461151632764cc7693e9d3525e495aa3c9ae1fb0
SHA51259303381117ced1d99f67fbb10921e34f7ba066edb937ae6e27262941772a48fbe40b861a2954a1e40160b0661f1e2140377ee128ba9600715f6459b65c1bd72