Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-01-2025 07:43
General
-
Target
JaffaCakes118_487cf5488339ab458fb7f5e28dca4418.exe
-
Size
1.5MB
-
MD5
487cf5488339ab458fb7f5e28dca4418
-
SHA1
84ff99d12ac7018a3be7cfd92475ed9a80db60d4
-
SHA256
8074064c28f8cbda04e8f10457f99f2c05e12fa35744f897dbe407df2f196d4f
-
SHA512
a6533923c32d52fd3f96ac8b50ee01e271ced19cb0bb14bfb9dee01a0ddd783f433ce8877498815487c92a7da90c0092a7b87f367d0a8c08f235cc1a6b0946ca
-
SSDEEP
24576:HvOgVT287uEhl//y0hkprMpRLo1ShDiYU9gD4JFMshK7OkmIUrAHLV5JzPcIIOo8:/pNPDjKKDZg6D4JFjZVh0HvJzPcKoGW0
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_487cf5488339ab458fb7f5e28dca4418.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_487cf5488339ab458fb7f5e28dca4418.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\foto tools\20.1.15.05\2012.04.01T14.19\Virtual\STUBEXE\@APPDATALOCAL@\Temp\foto.exe"C:\Users\Admin\AppData\Local\Temp\foto.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\foto tools\20.1.15.05\2012.04.01T14.19\Native\STUBEXE\@SYSTEM@\GEVKCR\KIO.exe"C:\Windows\system32\GEVKCR\KIO.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD551507d91d43683b9c4b8fafeb4d888f8
SHA1ead2f68338da7af4720378cd46133589fc9405ba
SHA25671b3aecefd36e4855a369019ac5871c544d39f8889d23cd455466a24cdecce6b
SHA512a5a7ff3f8ffb72719b7e2c9dc2719c99ea32bd68994918ea027c0d7d54cfe0c80bfd34486dd8d3cdd390376bc4c8d1f7d97de4b98b7d39a3e10c3e2682c07d1c
-
Filesize
43KB
MD593df156c4bd9d7341f4c4a4847616a69
SHA1c7663b32c3c8e247bc16b51aff87b45484652dc1
SHA256e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e
SHA512ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35
-
Filesize
1KB
MD518a2b243d3aea494be8c54432e367ee5
SHA1c4cf2bde70c65c9b68d95394dbc226d6ae20912f
SHA25641338db0d3a536f276fcb161f54232dfffeb32e3cdacb1688c8d2455c33ee900
SHA512013e0691e3f5a720c8837b0c67d6cf6ebbaa225c2ccdf656bb49c1e12c84533b2e6ea9964a2b4651c6280691672096804e90a04e18f6372d618f31a3b60771c3
-
Filesize
1.7MB
MD53cd29c0df98a7aeb69a9692843ca3edb
SHA17c86aea093f1979d18901bd1b89a2b02a60ac3e2
SHA2565a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32
SHA512e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9
-
Filesize
17KB
MD53c69601eda703669caf6e866408f02ca
SHA16c7a9efe6ce4b5ecba79bc52a51ea8feb3a4aacb
SHA256036ae1db34e1964ca5745e3d9bf2028ace023a63362164c6eae3219f0ab5d52b
SHA512fdd3dcfce298b012b0a8264b6935eb0cf1afdb483ad7479dae0ba658084ed22f7405b8d5812bb7db10a211d6885dd287ccb1752875adb0235c6763a6d5fd092c
-
Filesize
17KB
MD57e46c48d81b1c06f15c173959b062b50
SHA16db277fc5cbd7b125da2abf47bed96f5243cfa41
SHA2561949f9360028d911b417f25a4254d0a3c3ebc90ea10ecdd7774d0e865ff18055
SHA512fa09a67530f3e44a36ea2915e1f6bfcc26ae9ed663a2b9c61b1d3dc0abb1e4056d8708b78615e0aa0e8fdc8ca7239d41d56fdac878221b8d27f9e67fea1d33ef
-
Filesize
61KB
MD5383d5f5d4240d590e7dec3f7312a4ac7
SHA1f6bcade8d37afb80cf52a89b3e84683f4643fbce
SHA2567e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422
SHA512e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
432KB