Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 07:48
Static task
static1
Behavioral task
behavioral1
Sample
e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe
-
Size
375KB
-
MD5
e083d0b45407aa0e406560cea0b34257
-
SHA1
12f455771fa47b801d0f15b22a706b52207a4c70
-
SHA256
099f2218b8bfb328833051e0ac0030079fa9dc627c655f9e39f2de0b81df749f
-
SHA512
2889201dce3930d0698368ab0012d7a4fe5f705a29e1266060a198a990192ae43d391ea1cd9d698f318e44bd333dfec61f9d217e6a16d1fd679a3737cd48e032
-
SSDEEP
6144:kBRt5X9Eb9dIvU2lF3Ief5XzarDxXDj9uk/0qaGC5fmXvKkTCVpn7UqqeoCmc2N5:kPtpAdIvHB7hXzafxXDjQUO1Nm/KF4aY
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b87-35.dat family_ardamax -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Exporer32.exe -
Executes dropped EXE 2 IoCs
pid Process 4740 Exporer32.exe 2992 XMQE.exe -
Loads dropped DLL 4 IoCs
pid Process 4740 Exporer32.exe 2992 XMQE.exe 2992 XMQE.exe 2992 XMQE.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XMQE Agent = "C:\\Windows\\SysWOW64\\28463\\XMQE.exe" XMQE.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\XMQE.001 Exporer32.exe File created C:\Windows\SysWOW64\28463\XMQE.006 Exporer32.exe File created C:\Windows\SysWOW64\28463\XMQE.007 Exporer32.exe File created C:\Windows\SysWOW64\28463\XMQE.exe Exporer32.exe File opened for modification C:\Windows\SysWOW64\28463 XMQE.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\PCGWIN32.LI4 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exporer32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMQE.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{E746B752-FCCF6D35-1B89DA67} e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\{E746B752-FCCF6D35-1B89DA67}\ = "515394878" e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{EB47B875-51D73266-39658D22-FBAB0658}\ = ff3be5f0af365a8da9fb008e599a5390965562dc3f948aafbe6575d3bc66f53d83f4ae0e84fbc049ed1c7b15cee085589fd39591506caf997a50372f9efad8c868f7642f9504efc31a36e943b876cafd270b021e676bf2e13e207507409da928fb61b61cbc55f4533f66ca9da12b3b9eced4fade762b83a691c36f817ae0711eb81435a3b039b80ccf6545c07cf6c8b34501c07894cfdd052bec26b8a37319b6543261cfa445011c8829421cd7d79d5d68e87b403617f31201d1681761ad8c38d8319708ada4bbe1095f9cd594dc6caa99ffd73592409827513ddc3456bd2dcbc4863fb2ca8e871b5d96a85c5ae9eee785dda32899811037d542d379ae8c7a07896203216e0c25657080715ab46f731a0eae5bfbae4965bc404a2907a4b2d2f05745e29cfe94b56fc39af1d104e3e136f883b62932233f264abde037e342890923070e0225bfbcf5088cd95aafe9dabb5089eaa4995e97ab9d4114d7d162e7f992cf5065af8c05baa336be83b4a93e5fcbaaf9c08fe15a13d7a1dd5c942920b8e770ad7a1bf12ef35bc9aec39a4e287ba236b7cdbd1bf7aef23a38378e7265c7f0ddb76b4de684a2424939a4b410ccd559a3acdea4144123a456dde2abc77e7d8bc81e7e6b7559fc54089f2515bce0f4a27311c6e892faef89451fc34de78fba24b604cad19c3cdfc21cf79cf073c6e40a94888cbf7c69ac78633d2405a54db00ce9e04427e5d7e925906e5820c68245 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\{EB47B875-51D73266-39658D22-FBAB0658} e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{EB47B875-51D73266-39658D22-FBAB0658}\ = ff3be5f0af365a8da9fb008e599a5390965562dc3f948aafbe6575d3bc66f53d83f4ae0e84fbc049ed1c7b15cee085589fd39591506caf9993c6e58899fad8c856badc319504efc31a36e943b876cafd270b021e676bf2e13e207507409da928fb61b61cbc55f4533f66ca9da12b3b9eced4fade762b83a691c36f817ae0711eb81435a3b039b80ccf6545c07cf6c8b34501c07894cfdd052bec26b8a37319b6543261cfa445011c8829421cd7d79d5d68e87b403617f31201d1681761ad8c38d8319708ada4bbe1095f9cd594dc6caa99ffd73592409827513ddc3456bd2dcbc4863fb2ca8e871b5d96a85c5ae9eee785dda32899811037d542d379ae8c7a07896203216e0c25657080715ab46f731a0eae5bfbae4965bc404a2907a4b2d2f05745e29cfe94b56fc39af1d104e3e136f883b62932233f264abde037e342890923070e0225bfbcf5088cd95aafe9dabb5089eaa4995e97ab9d4114d7d162e7f992cf5065af8c05baa336be83b4a93e5fcbaaf9c08fe15a13d7a1dd5c942920b8e770ad7a1bf12ef35bc9aec39a4e287ba236b7cdbd1bf7aef23a38378e7265c7f0ddb76b4de684a2424939a4b410ccd559a3acdea4144123a456dde2abc77e7d8bc81e7e6b7559fc54089f2515bce0f4a27311c6e892faef89451fc34de78fba24b604cad19c3cdfc21cf79cf073c6e40a94888cbf7c69ac78633d2405a54db00ce9e04427e5d7e925906e58035901b7 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\{EB47B875-51D73266-39658D22-FBAB0658}\ = ff3be5f0af365a8da9fb008e599a5390965562dc3f948aafbe6575d3bc66f53d83f4ae0e84fbc049ed1c7b15cee085589fd39591506caf997a50372f9efad8c856badc319504efc31a36e943b876cafd270b021e676bf2e13e207507409da928fb61b61cbc55f4533f66ca9da12b3b9eced4fade762b83a691c36f817ae0711eb81435a3b039b80ccf6545c07cf6c8b34501c07894cfdd052bec26b8a37319b6543261cfa445011c8829421cd7d79d5d68e87b403617f31201d1681761ad8c38d8319708ada4bbe1095f9cd594dc6caa99ffd73592409827513ddc3456bd2dcbc4863fb2ca8e871b5d96a85c5ae9eee785dda32899811037d542d379ae8c7a07896203216e0c25657080715ab46f731a0eae5bfbae4965bc404a2907a4b2d2f05745e29cfe94b56fc39af1d104e3e136f883b62932233f264abde037e342890923070e0225bfbcf5088cd95aafe9dabb5089eaa4995e97ab9d4114d7d162e7f992cf5065af8c05baa336be83b4a93e5fcbaaf9c08fe15a13d7a1dd5c942920b8e770ad7a1bf12ef35bc9aec39a4e287ba236b7cdbd1bf7aef23a38378e7265c7f0ddb76b4de684a2424939a4b410ccd559a3acdea4144123a456dde2abc77e7d8bc81e7e6b7559fc54089f2515bce0f4a27311c6e892faef89451fc34de78fba24b604cad19c3cdfc21cf79cf073c6e40a94888cbf7c69ac78633d2405a54db00ce9e04427e5d7e925906e584804ef55 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2992 XMQE.exe Token: SeIncBasePriorityPrivilege 2992 XMQE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4104 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe 2992 XMQE.exe 2992 XMQE.exe 2992 XMQE.exe 2992 XMQE.exe 2992 XMQE.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4104 wrote to memory of 4740 4104 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe 83 PID 4104 wrote to memory of 4740 4104 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe 83 PID 4104 wrote to memory of 4740 4104 e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe 83 PID 4740 wrote to memory of 2992 4740 Exporer32.exe 84 PID 4740 wrote to memory of 2992 4740 Exporer32.exe 84 PID 4740 wrote to memory of 2992 4740 Exporer32.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e083d0b45407aa0e406560cea0b34257_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\28463\XMQE.exe"C:\Windows\system32\28463\XMQE.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2992
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5c3679c3ff636d1a6b8c65323540da371
SHA1d184758721a426467b687bec2a4acc80fe44c6f8
SHA256d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
SHA512494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
-
Filesize
271KB
MD5df66ed4d370256afa8b21dc427668f35
SHA1bed981e7beb34b02eb4e19d73305d0b89d8c084c
SHA2567ede9c3af535ea15967c9c224b107d00024dbcd1f4d513704124a57d53f7c48e
SHA512ab396b31e89a7f42b24592ed7a61b3fdadad768598c98520623b63961665de10c41ea1d45badfde854ca719b9a9af481d7ca6c68d7aa9c342848a4ee6ac86ca7
-
Filesize
416B
MD56372c4732401ac075e0d8258a7a7f87a
SHA1e1af727c3212e3f2d815b285e3938038e889dbb4
SHA25655b7af36e6d06ccd06b2be2d0441361d1401eeb8139618d86ec9d3e9c6f7d09d
SHA5129968bd683d08a35ef7bb12951b4ed5e3f8c7dc84ac7dc83dd4bad378889c8dc38d4213eb264c4188bff3611b99d5030d76de20934378679f8c3111916f9dfd61
-
Filesize
8KB
MD543f02e9974b1477c1e6388882f233db0
SHA1f3e27b231193f8d5b2e1b09d05ae3a62795cf339
SHA2563c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
SHA512e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
-
Filesize
5KB
MD5b5a87d630436f958c6e1d82d15f98f96
SHA1d3ff5e92198d4df0f98a918071aca53550bf1cff
SHA256a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
SHA512fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
-
Filesize
473KB
MD517535dddecf8cb1efdba1f1952126547
SHA1a862a9a3eb6c201751be1038537522a5281ea6cb
SHA2561a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
SHA512b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8