Analysis
-
max time kernel
93s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-12-2024 20:27
General
-
Target
e31655d1164a77e6a19d811c310372a3_JaffaCakes118.exe
-
Size
480KB
-
MD5
e31655d1164a77e6a19d811c310372a3
-
SHA1
ecb0482d2a504c72073c515cde953d1d1d633e01
-
SHA256
11e48892351418f6d4a81ec4c4639122c68b60731ceee4ce0325f23c686018b7
-
SHA512
19c399bbaf929394d4e68c134baa7c832d763bfa92dd61ac32b09cc3d43e5e125d808f1941d9ca4fa38f621e77d2970138afa47c92c85dbb5612157661b2ffdd
-
SSDEEP
12288:GLJ+UpLJWZ53y0YkddXgu813R80303gGNxQFRj74bU9:yfpI73yVGFij8l5NkYa
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e31655d1164a77e6a19d811c310372a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e31655d1164a77e6a19d811c310372a3_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32OXKN.exe"C:\Windows\system32OXKN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5b7ea0bc4bb833ab77dce179f16039c14
SHA1b05cc205aa6ffc60a5316c1d5d3831def5a60c20
SHA256e7bc62fb964bacd8e3189f22a8d64a27bddeb90007a38da3d3e6b58f6d8a2dba
SHA5125a4ad9b469c7502a930158ca2db814b0b84880b2658a6a6dcca9fee60e6c8dc5f8a3c8d09e280a026d63e3d48b5291074827d16f3e680ce87645d8aad996a652
-
Filesize
418B
MD525c85fe0c1c3b576edc41e394a8288cb
SHA19aaef173d5559fd8d30d999202895e44d3d9ae68
SHA2565ab19f509f192a1289d9dadab6606e0dc5291ac91dae68d052cf32d801b73a3d
SHA5129e901bbae87d06b89bffc37d5b141154798279952c8153b8988604ba2c74043634b7c1019371ec40251396540d49bd0170aa63a8be525c07145745d5f23c5621
-
Filesize
7KB
MD587ccf7eb039971590aac6f254b2c788a
SHA13095496ffd364b32cdbe63ba4dd2f477fd848515
SHA25659973b04dd9bec56a7ff9d898fda25e9214ee7652f2687ba409b435ae07e554b
SHA512d5f9f7855725021522fae819a855d3d2d2cf028b0ea3ac191ad02039cbb688af42b191a1ec4f1868365e2f7de36acca2b7ba3bee0a7b8447820c4521e942d8d2
-
Filesize
5KB
MD581938df0dbfee60828e9ce953bdf62e6
SHA1b1182a051011e901c17eab2e28727bec8db475fb
SHA256982e2e47e8af4384a6b71937fb4e678a61fbc354f6816204e14a01d325529a98
SHA51264ebe41c17f55f725aeb946b1a7843ad27062490a3e9cc49df7ecb3e5e408444c766236642986cbe499e876e91d1d95d4aafe7d044fda3f5370bbe5f71532143
-
Filesize
471KB
MD5912c55621b4c3f0fb2daef5b4f4f5f4c
SHA1735701c75569b7563950508afc8948b52e7bf4b2
SHA25641ecb7a6e3e9c32ce1bbfdff8fe381f6c21fc1f601f7e9be9fcfa2678d2420a0
SHA51265a08579e959d4beebb5ad026cab451d381e147621be8a0707baca748eaee22050c020e3d54f312376eaf6f20a1fc3713e5e07cc9d4ee7f32b7c17dc15c80d05
-
Filesize
4KB
-
Filesize
4KB