Analysis

  • max time kernel
    141s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2024 20:27

General

  • Target

    e31655d1164a77e6a19d811c310372a3_JaffaCakes118.exe

  • Size

    480KB

  • MD5

    e31655d1164a77e6a19d811c310372a3

  • SHA1

    ecb0482d2a504c72073c515cde953d1d1d633e01

  • SHA256

    11e48892351418f6d4a81ec4c4639122c68b60731ceee4ce0325f23c686018b7

  • SHA512

    19c399bbaf929394d4e68c134baa7c832d763bfa92dd61ac32b09cc3d43e5e125d808f1941d9ca4fa38f621e77d2970138afa47c92c85dbb5612157661b2ffdd

  • SSDEEP

    12288:GLJ+UpLJWZ53y0YkddXgu813R80303gGNxQFRj74bU9:yfpI73yVGFij8l5NkYa

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e31655d1164a77e6a19d811c310372a3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e31655d1164a77e6a19d811c310372a3_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Windows\system32OXKN.exe
      "C:\Windows\system32OXKN.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system32OXKN.001

    Filesize

    418B

    MD5

    25c85fe0c1c3b576edc41e394a8288cb

    SHA1

    9aaef173d5559fd8d30d999202895e44d3d9ae68

    SHA256

    5ab19f509f192a1289d9dadab6606e0dc5291ac91dae68d052cf32d801b73a3d

    SHA512

    9e901bbae87d06b89bffc37d5b141154798279952c8153b8988604ba2c74043634b7c1019371ec40251396540d49bd0170aa63a8be525c07145745d5f23c5621

  • C:\Windows\system32OXKN.006

    Filesize

    7KB

    MD5

    87ccf7eb039971590aac6f254b2c788a

    SHA1

    3095496ffd364b32cdbe63ba4dd2f477fd848515

    SHA256

    59973b04dd9bec56a7ff9d898fda25e9214ee7652f2687ba409b435ae07e554b

    SHA512

    d5f9f7855725021522fae819a855d3d2d2cf028b0ea3ac191ad02039cbb688af42b191a1ec4f1868365e2f7de36acca2b7ba3bee0a7b8447820c4521e942d8d2

  • C:\Windows\system32OXKN.007

    Filesize

    5KB

    MD5

    81938df0dbfee60828e9ce953bdf62e6

    SHA1

    b1182a051011e901c17eab2e28727bec8db475fb

    SHA256

    982e2e47e8af4384a6b71937fb4e678a61fbc354f6816204e14a01d325529a98

    SHA512

    64ebe41c17f55f725aeb946b1a7843ad27062490a3e9cc49df7ecb3e5e408444c766236642986cbe499e876e91d1d95d4aafe7d044fda3f5370bbe5f71532143

  • C:\Windows\system32OXKN.exe

    Filesize

    471KB

    MD5

    912c55621b4c3f0fb2daef5b4f4f5f4c

    SHA1

    735701c75569b7563950508afc8948b52e7bf4b2

    SHA256

    41ecb7a6e3e9c32ce1bbfdff8fe381f6c21fc1f601f7e9be9fcfa2678d2420a0

    SHA512

    65a08579e959d4beebb5ad026cab451d381e147621be8a0707baca748eaee22050c020e3d54f312376eaf6f20a1fc3713e5e07cc9d4ee7f32b7c17dc15c80d05

  • \Users\Admin\AppData\Local\Temp\@13DE.tmp

    Filesize

    4KB

    MD5

    b7ea0bc4bb833ab77dce179f16039c14

    SHA1

    b05cc205aa6ffc60a5316c1d5d3831def5a60c20

    SHA256

    e7bc62fb964bacd8e3189f22a8d64a27bddeb90007a38da3d3e6b58f6d8a2dba

    SHA512

    5a4ad9b469c7502a930158ca2db814b0b84880b2658a6a6dcca9fee60e6c8dc5f8a3c8d09e280a026d63e3d48b5291074827d16f3e680ce87645d8aad996a652

  • memory/2864-18-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2864-21-0x0000000010000000-0x0000000010006000-memory.dmp

    Filesize

    24KB

  • memory/2864-23-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2864-22-0x00000000003F0000-0x00000000003F6000-memory.dmp

    Filesize

    24KB