Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-01-2025 03:53
General
-
Target
JaffaCakes118_137cc722921829df11208ae82a652cd7.exe
-
Size
718KB
-
MD5
137cc722921829df11208ae82a652cd7
-
SHA1
06b7cb4353456aa6609c767930636165ac388ec4
-
SHA256
75f22218e16289f3a8079a28532434d795b30dbb43b2a688fae8578221ccd736
-
SHA512
bdf93865dda2b25494070a1d886aa9c1b95a68210ed01a4a082ca31bc8d38588e62e6045de58c2d893f086255f5fa237f4e96036f87a0c5c0b390d71ca73ef6e
-
SSDEEP
12288:1TRWsN4vWGWzJzzsMtTtsY+KqPIwztvOWKpO0Li7vB1iVuqw87R:ShvW/PsMtJyzvtGWKpzLi/rZ8t
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_137cc722921829df11208ae82a652cd7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_137cc722921829df11208ae82a652cd7.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32HBID.exe"C:\Windows\system32HBID.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Project VDC.exe"C:\Users\Admin\AppData\Local\Temp\Project VDC.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD551bee0ab97691836dc058cc6edb0a3bc
SHA1e7a79d9eeaa9b3eb4650389d590e72f3305767d4
SHA256fcb57ac50b7ced25bba2f806824dbbbcdf26208a1ceb2244c6f52a572b1f5f06
SHA51292e15cf965bf2e4c258e6bf53543647b470fba9376c0fb3e9cc8d003f3be74f87f7d7935cf67b66205f1cc103df613856e2aef129a4b373336b1f0f1b5645fcc
-
Filesize
243KB
MD597bacf4e79415c1bd1afa578eefb2e35
SHA1f7ae523b22e44106e4be136098f367614fd6061f
SHA256b7488daa93b04130e29a35ac6c6445fdd6f240824a6b98ab76d2c87e9bdabc52
SHA512a6524e2d74ab97e8158ed3457ba3481f70278ae7cba5ea861f59c60acd5dba4e3177124ebade52e94ca9f0d85d0a3d5c6b249f3b287d543645b4e4ad75142303
-
Filesize
548B
MD51f91a75464d0a381ba3bea745365ade7
SHA1f9fe08c9a420088e6a6cf7e3b093dacd8155c01a
SHA256c4955dfe16787cce82668fc42fa2845fd2120588e7f7aa9dbbba8fd1f956d862
SHA51250785c2a7a7113132c4e0e42ea15b0c060db7c56417b969657eeaccd9fc82323305916ed17057d323bf7a449c41c1655a9e9ef6cfa0fc084e2a2817bb39d351b
-
Filesize
7KB
MD5ed3c7e9a789e0c5c8c49e46d4bf6a3df
SHA1e74e617680edd83ea0172960c4389ba3f7ed431d
SHA256f2b983e3e8cdcad665bdd0024725bb03a1a4919dcf115d031d1d4e4fe3225856
SHA5121c70224ccf2d95563d54c8eb52e0e3fc09dee8528a8a0041517f1f85f36eec5f08ed5b8e9064827290a7b66f48849575ecb2cce3e81b4250e12806ffb7aff06d
-
Filesize
5KB
MD5d7b3b4076038485800c17684ac22550f
SHA1d6ce8bc1a16d46cf6bdae41308f4eafd8d24ae4f
SHA2567f67f9360d43cc337ad5f878372e1eec94a83e7cf6b5cf56c43a8c7e2e8d869a
SHA512209eae97c7854f26fb32132be5722a5fb7b0c275774599b456b3f8a99c5b70d90a676ecf17ab7867c47a0f653c3f7d80d02d902ddb116acb7ba366ab0662750b
-
Filesize
471KB
MD5186403d9ea3c30fb5c9cc7ec135c7866
SHA10b2ee531ae2f5c0658ffa720c1c71e986433a4fc
SHA25699b102ae1b219cc471c47aa54da4ab4c3f4d0ee7a07ef85c7f0bca8cc6eb9bf1
SHA512af30f64237e9998c4c2c41213a67c0bbf8687318c8e957f8a87aff43e383dd301ca674e0158cde5ab209bcf03263625fefcd0b6602c14f3d40231da7d9809dcd
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
440KB