Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-01-2025 15:54
General
-
Target
JaffaCakes118_cc1644ec5ead390052f977054f42990b.exe
-
Size
1.2MB
-
MD5
cc1644ec5ead390052f977054f42990b
-
SHA1
ddf8f71466533b2a6765fcbe04e6690f470b86a8
-
SHA256
2b2556ab9e99e5ba8c2ab5118935887f67bbf336225fa7ffbdbee008917b611c
-
SHA512
17a652f43bd8e256de49014dee727a33f857b135d9581840b5e993409aa3c2bce891f640acfd373cabddd3544603561671cc01a65c42feafd53824f559f43490
-
SSDEEP
24576:/U4oTv8la+1fIeQZJ3nrBBtKRWBbfMHeRlWZ6zSoosHYImQCaQ:/ULTvmIeWTKcbSoDzboS56a
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cc1644ec5ead390052f977054f42990b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cc1644ec5ead390052f977054f42990b.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\OKOTRO\UDD.exe"C:\Windows\system32\OKOTRO\UDD.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD548cfaed4d566c34716326302b49bdad2
SHA1566e0989b6bc7ed205f9ae250ea98e3a4d7fba52
SHA25654c2e10de3ed7135d20c239a7f656c6ff57d1158607fa4c6779e042681de87ea
SHA51296c871ed9af039142aab5904021d3ef3f75a58c5cc1fdf4d59e40e3699fd03e7cff384b788f7359a1de519ebdcafdad55891fef4f67e2c216ea89ebc945996a0
-
Filesize
60KB
MD5a15c556f17d7db8287e023138942d5db
SHA1880bf8ec944120830dc2e2e040e5996e4e0e6c83
SHA256f3716810ab011a4cb7693d31b69cd540380ef2a067724e0d568070c8a558694e
SHA512930339711e3d73e5af0778367a648c94411c20d23bf4c27ec5d72222e76b8902eb3fc0992d70cc4141600c19087159514246d42f1e762c98dad306f8e0bd99cd
-
Filesize
43KB
MD5daabecdfba287a3333b60ae82211acd7
SHA1e67b4c7bf0dd71ad47263a58bb60be4bce504b84
SHA25612981c35adf6f00c7dddbc3ab23c04c30133cc5be107015dab9fd7ba4e8b4173
SHA512937f551f959bd823292fe5983bbfb1c3a6dd86426a5da228dc7ddba38138c898599bc713d707b9d3463b20825cee0783d92c1c19019cd0328986a8aef5c1222f
-
Filesize
1KB
MD503d1bb338ca97776519490f945712b60
SHA18926feb7dbbc5508472dfd7ced0d07b1ec1bf774
SHA25698e165704a2208d2fb8504c10a6f4f1778efb9219e25ec6ff97e8c5a77864c12
SHA5128a14bd82c365f37854e414dd78bca936e5b6a08ff861e8627399aef8899d6fe631b1472e56b633193f93c9bff0358152811a687b64f2d22eb271576ab01817b5
-
Filesize
1.7MB
MD5f3819a6cab8ae058254c4abb3844d87e
SHA10f8b1a74af87f1823ec0d76e21a8d54d55a53a8b
SHA2563d656d1364b4b2382020f64990a2c630b7b9422ca7b7fe2c30646fda3303e6c9
SHA512dfe9d342f3ad543fec8bd278e21ac5059b1c36ed3f735734e9b92d639cb25609f9307862ab2b35ea3e88713f4a652abe5863871225f915462c79d493ac5e1f57
-
Filesize
4KB
-
Filesize
4KB