Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2024 23:48

General

  • Target

    dc10cebd6b10497df0c20122c7a7486d_JaffaCakes118.exe

  • Size

    949KB

  • MD5

    dc10cebd6b10497df0c20122c7a7486d

  • SHA1

    244981c18e0ec8a6640a52eaf3d0e6f8789886a2

  • SHA256

    8540c7625e72bdb8522fa30290cd453beceba4df355f0f7b4670deea08fa374b

  • SHA512

    746c064c9d5a7c4fe752b5fcee6a39af5403e62f43f7adcdb2a04a4ae42df9ca17e5ab695a3ba280370a6dc3f94ee404362710ac0fe157ff7c64f6d923e91769

  • SSDEEP

    24576:H64MVT9BYxFdNaJVvH5TCFuKzP7opuFD:H64MTExahoFumrF

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc10cebd6b10497df0c20122c7a7486d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dc10cebd6b10497df0c20122c7a7486d_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\SysWOW64\BWVRBL\TAI.exe
      "C:\Windows\system32\BWVRBL\TAI.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\BWVRBL\TAI.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:828

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\BWVRBL\TAI.001

    Filesize

    61KB

    MD5

    383d5f5d4240d590e7dec3f7312a4ac7

    SHA1

    f6bcade8d37afb80cf52a89b3e84683f4643fbce

    SHA256

    7e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422

    SHA512

    e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a

  • C:\Windows\SysWOW64\BWVRBL\TAI.002

    Filesize

    43KB

    MD5

    93df156c4bd9d7341f4c4a4847616a69

    SHA1

    c7663b32c3c8e247bc16b51aff87b45484652dc1

    SHA256

    e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e

    SHA512

    ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35

  • C:\Windows\SysWOW64\BWVRBL\TAI.004

    Filesize

    1KB

    MD5

    bf4d6943f37a457817347628308413d5

    SHA1

    56378906a72b6a54e4530e58f1110c64bd5123ce

    SHA256

    50836040a3322f38cedf4ec76ab84ccdae1a41a5d655d57a3856465cd8e60309

    SHA512

    3f96cd3002870951b6b11a9066777b9e2ee18b60440d9a9da791c4f191fd1d188337fc5cd718825cf808b231068b67b8df9d5f61c331828009d71a84b1662289

  • C:\Windows\SysWOW64\BWVRBL\TAI.exe

    Filesize

    1.7MB

    MD5

    3cd29c0df98a7aeb69a9692843ca3edb

    SHA1

    7c86aea093f1979d18901bd1b89a2b02a60ac3e2

    SHA256

    5a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32

    SHA512

    e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9

  • memory/2360-14-0x0000000000600000-0x0000000000601000-memory.dmp

    Filesize

    4KB

  • memory/2360-16-0x0000000000600000-0x0000000000601000-memory.dmp

    Filesize

    4KB