Analysis
-
max time kernel
95s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
06-02-2025 16:55
General
-
Target
JaffaCakes118_ad73a5be50bd45a1b28ec1878d2c38f1.exe
-
Size
144KB
-
MD5
ad73a5be50bd45a1b28ec1878d2c38f1
-
SHA1
22452f2dfe3884c8cc20aa0de50404a298926fdb
-
SHA256
e1c5a78e93d2f81ff5db185c5f0a3b6ec7bb23e7d252450129c014184728471e
-
SHA512
66770d9043a35066f2f31bbb9e7e1cd20a767dd43f60483ce47c0cc2bcf74bd221d7a237469a7db3cdce2ede1c64f6b1f6831f01b1cd9174d37f17ab69bb8ef6
-
SSDEEP
3072:iOBghpRsVGqa7WIyqHXDu0W//3rNPPJMNfIcyR4hVOD5l/MRzferA/L2v:8fs1u3DNWnZPJgIc5GFlEln/LA
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ad73a5be50bd45a1b28ec1878d2c38f1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ad73a5be50bd45a1b28ec1878d2c38f1.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\AKL.exe"C:\Windows\system32\AKL.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5de3f9e4f680ff22e8712fa9b32ff85ee
SHA10cc885ed6502b3b610af57ee2095410751d9dd78
SHA256477f789ffe931ee11197de814231fdc770e6e6c1e94b0fec5bee0adecd32dd03
SHA512daf04bb16fec1130dc08e72b7f28b0041b2eb78900e1464e15f1e20e1705a0de24d3df0de8111a42aed03d73db6f8eb5e30c87f34b4a745d4aa27d84e09d9f90
-
Filesize
1KB
MD5e3a3e559139872e5fb167360d94e26f4
SHA1bd1ab371fc016a81cca2465c06a633d8f879b303
SHA25689fad112540b22fdfa6e11e43dae6e1eb9937e2b92448bf43bade4aa310b07ac
SHA512a9813d1196f2d182f6a7f84b0494f32c65a6d5d3e53df1133c1db0a5d7ecc644522651a6ab66d57abbbf837782a315ecbe724c307203933f71d89510f29851f4
-
Filesize
4KB
MD51153fe5fbe61266713539cae72d87ad3
SHA1245047d3d158f4eda34290ed22e4bb13a28f9539
SHA2563b2700a8033916afd0e89ab5519702720f35b94a570ebe865df113f2aacda16c
SHA51224058cdebaf8ccfc00622301927b221116b846c2a8acf8f0935ba30e0d716bfecd6ab07aaf8d93030ec2149ee98eec5f6d2395ee8a1a62ad00e07124447c107c
-
Filesize
6KB
MD5049989542b610261bde51aff6b71d4aa
SHA122de68b6548faf1ec1b52f14a1f197fa5152babd
SHA25648cabcd5da354d4018809d12ca445c4c6324250f22450aca04222c214b9ae42d
SHA5128cc0cb8167598e50a91230061cbe12d0d724151dc454f6cf0dcd5074efc704602796a9a136e53f609a6d54ad6c468aff2db263ad72b4b7d7febd32656eece34c
-
Filesize
231KB
MD579c6903c4794af027053331946137b26
SHA1b688916709014fc874c5b7870553105a9961c652
SHA256f3cbf3dd3f229f6119a8be5357959b77af1a43f9d568a7febe9a06f7593b20ed
SHA512ac28813dcdc38ff1b0736b1673ced7e35d7da5667b0224b88952908564373ae61aff1b0f03d27e40b613559c8d4e37c402269791db2ed1311f62d069a2e5111e