Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/01/2025, 03:25
General
-
Target
JaffaCakes118_4662b6b068f968b089f5767ed9404cc0.exe
-
Size
1.7MB
-
MD5
4662b6b068f968b089f5767ed9404cc0
-
SHA1
7e2e33e400c8f676e77c01e3432d7864c758d732
-
SHA256
d8f9db1f77dea1a06f8bc3d381ee6e63ed859243d718f98ea840aed6d1d50056
-
SHA512
b1038defa833c60c5832ee9c54844fae70efb0b3d7a849d4b0b2047b1c0882fa423bac663501f53cc9db0d972a83f5cdb5e04c8605f69d3d2d2a1fa8aee89655
-
SSDEEP
49152:LQijuS+GKkC7Q455bkJZ14xlBTUKBLmPYni4bHcrkKmP:LQWuS+B17QM5YbCxlRB9bHqvU
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 16 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4662b6b068f968b089f5767ed9404cc0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4662b6b068f968b089f5767ed9404cc0.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Sys\BVAU.exe"C:\Windows\system32\Sys\BVAU.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Opasna crnka pusi - erotski.3gp"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5007205a9e8bdde6cca968bb071c91f03
SHA1c3a53aa89a3273208752e9b0b4eaeb7e0a7bb4c7
SHA25669162537742ac573aff4b881709e9d3bed3d435ea96ff5fa2d7fe8a12fba3c2d
SHA512daa8a026fa1d2f09fa29520ca4b4b05977b577e396cb26ed5c637d3730def54856f560cb2fc30db0a74fa66ca739b6f872d3eb92bdcddc9230f82f9f81a85faf
-
Filesize
387KB
MD5bcf6fab667525797024d0962e41e9b7b
SHA186b3d41b65eb4ed85c6610a4bb595df787bb2a6a
SHA256916385eb000bc6011cac9b11d89fd08ffaaddf7d727f9c9bf0764bbcf905b877
SHA5127e04832d129e3bacb4d4d83259ec02e1e6f5da4da742dbbf010345ccd90a0547e12fcca68da3cff284687a112f570ca269596512605715b3477ae99933afc82c
-
Filesize
3KB
MD5e803ec9ff94c31dcd5f2644cc39ea3d0
SHA115b69ff5d2536d87bdf502d6648485dea5fffcfc
SHA2567b8024d433583b2267ead222b012691a158639dcbeb9996158d0b5d12f73cd04
SHA5121dacb5502a287c7009bfce7c8abd0381a906cfe977edebb02ff0b006e72a5d05a696fa75d8c8556ad3d8a3fea891da9bfbf603347eb07faab99ec6c9e8e93c48
-
Filesize
5KB
MD53a2ef41ad6d9415229e0b76ec6df1baf
SHA1e72f2c0d664a4d2323872bd1f586ec60bb0a6342
SHA256b7e321cf9dacead275e600c2b531e96a62c671e0a2d641e141acbefb509adf2b
SHA512b8d5f62e7da21d4114f8764afb16bc409921935d3440f8e712740a50dd7a01f850cfda31f0a4b41e4f514d6bb64e407a83e8e034e5be65cddde27817c728caeb
-
Filesize
4KB
MD5cb576a1e67ddeb42dc0e23a541cefdb8
SHA19684e67a013de4f0f5066856f553674db0f2749c
SHA2568a9a4e62b646f072f6c1b5415b8461af96db307f59c4d32c9e4f455477ffc221
SHA512e173475fbf9541daa6790133ceef4b8af414491c0a198e356ba1b1c2fcbdcf7044e8b8ae22d72f39b2b7b888e254fd742b9b09ae3c4e63fa64b5171508247942
-
Filesize
4KB
MD5b429300c8148810d2e6a8d40009fc124
SHA193ec9660cc0d68cadc6c7f44b35ea0a0ef684ae8
SHA25698445d51b61014815fc43e44933e5dc126c4fe763545141e78ee1358e487b4b7
SHA51247a1cfdba6c1e04a322116538a62b22d61cf6b31966e53cfe4e54eb75a58530a7636e3deffcfb7e96ff2bdae2b99c7bcb312685d1ceac2f79c118f6347bf2407
-
Filesize
468KB
MD54b64ea8b01e25e1af067d11698778ce4
SHA120c4d03590cc3ef10e0b3ddbfcdf6fbb41149847
SHA25608b9f18c1098036ae8830caae054c451c66478490dcd4c653a01abaa937ee7c5
SHA5125bea198540fa4dd9234017ec3e7a0cf79da4d3bc53cb715a3a6335567c08ff0871b886d6f4dd80e9f4e9df4cac8be392fc7d0e3456c14624583c6cf337ce65d0
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
2.0MB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
2.7MB
-
Filesize
96KB
-
Filesize
260KB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
192KB
-
Filesize
208KB
-
Filesize
496KB
-
Filesize
92KB
-
Filesize
16.7MB
-
Filesize
1.5MB
-
Filesize
992KB
-
Filesize
348KB
-
Filesize
68KB
-
Filesize
2.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
68KB
-
Filesize
188KB
-
Filesize
24.4MB
-
Filesize
308KB
-
Filesize
264KB
-
Filesize
788KB
-
Filesize
264KB
-
Filesize
392KB
-
Filesize
436KB
-
Filesize
76KB
-
Filesize
2.7MB
-
Filesize
140KB
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
1.0MB
-
Filesize
388KB
-
Filesize
284KB
-
Filesize
464KB
-
Filesize
208KB