Analysis
-
max time kernel
94s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-12-2024 22:24
General
-
Target
dbd3e65a2ddb615c74b9228ec7a6c137_JaffaCakes118.exe
-
Size
566KB
-
MD5
dbd3e65a2ddb615c74b9228ec7a6c137
-
SHA1
6d73dd47393729129bcfaa233076b7dc2284c79b
-
SHA256
de5350dcbf479c545ee5b6a67958f035614fe4e006d71892889a3fbb21a3da13
-
SHA512
cd222067f452c9d52ae61239b50984127c02bb98a12a108ee32d56ee11d3f68cff23e306b97354369b138a7c9b815f09ae61cce2009f3001705781d9118ea3a2
-
SSDEEP
12288:JE4PSjVYyB7GTFgcomLEX2bm9diDEHPZD2PmeYjlTI4bC7O4COY2FrH:jPSjVYy92omwXvdioHFghYJBf2d
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 32 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbd3e65a2ddb615c74b9228ec7a6c137_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dbd3e65a2ddb615c74b9228ec7a6c137_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\XPGI.exe"C:\Windows\system32\28463\XPGI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 10883⤵
- Loads dropped DLL
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\XPGI.exe > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3692 -ip 36921⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f1cf9fcbddeadabb738de497ffefdced
SHA17385a7c87e245da89cc5ef8f9295678c1566f25d
SHA256086083bc73b14286f9c3c29df8b8dc6f014d8b084267fbaeee0af56344d1f779
SHA5123a3b9d279b4c131ef3f358e0163f60ec9e60160a2cc45488adb915fea6642f3df5d35da2ccb6983d790401d237fbc808829f42c42ef958e7a0eac98fc33bb3f6
-
Filesize
298B
MD5184b4040fafd89c8383f054011c8c004
SHA169fe0d06690b6336d0d1b200b1d32babc7bef11f
SHA256fadf0703c644a56df927770b4adb4b13a427f49bf6566e26786d2e22bedb3f5d
SHA5128f576d447d4de825c4042f0f352ab165a56bc30afb8ada26186f5dd7245defb953b7a3eb3c81f6f772a59278efec918f4f3adda9ffeb358e08d70f0323df3bc2
-
Filesize
8KB
MD531854a50b294dd312eb7fa9eb1c99537
SHA1e0b1682a001e15d0e0e1c1ca732cafb5c80b3160
SHA2562fe2d55aae2deef38a37c9679d74ecf05699d6919760794f69583b43b7fe308c
SHA5120482a4981ba242d4e931bd8b9eb5d606492cffb7609fb69fb349ed19c7a9e36a7e240e5ebe759505d253c5e72fb771612a76419c36fb035987a166569a5111c2
-
Filesize
5KB
MD5603451f504bedb28c3a7bae4c89abf24
SHA1cbfe12186b54663f60663c349739c7a49950c44e
SHA256e4d6577ea390274308877284b6d0cd6672aeb0e76c9c9847ac59c0964f050d13
SHA512136e28e288b3ce26b37c82b078a3440e3232c0f874d7d33e8e6fb6eadfd0024b9009448500c716523b81f142fa3bebf7d11f1dd3e8e6143867b06335eb5f9612
-
Filesize
648KB
MD5ce568bcaf7285124f764aff92f5079d4
SHA1886f698e2239cf615f12b503853a5fa28c53aefc
SHA25659d7d6de8a9e2d5535703d22c36888889530fd011d7f71cf034e93e36e7527af
SHA5129f6e3496930cb5dd9c9403acc865bc94f63f64af49a27ffeedbc9d9082d50bff4a7a772bb98d4a2719f0ecae144393de9cc273ba83ae00abe347b0be0d7c9866
-
Filesize
106B
MD5639d75ab6799987dff4f0cf79fa70c76
SHA1be2678476d07f78bb81e8813c9ee2bfff7cc7efb
SHA256fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98
SHA5124b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB