ardamax | 77f81037ce80d418a67b2bc86584bb33cec4b49cc7a6810f4a0036e08ff7eee7 | Triage

Sharing

General

Target

JaffaCakes118_b1fee1a0a26a8b490df859f74e4da284
Size

286KB
Sample

250207-cza9zsvqey
MD5

b1fee1a0a26a8b490df859f74e4da284
SHA1

9deef453906d6e30d345534236d9bad705fe1043
SHA256

77f81037ce80d418a67b2bc86584bb33cec4b49cc7a6810f4a0036e08ff7eee7
SHA512

63d1762c71cb406d63fe1b30f6d33228f561ece65cae089f7be303252829dddf2d46873c3d57d5fae97af467183cb97b598f96666f4ce04b4defd6d569cfe622
SSDEEP

3072:dXYe7o0Jz5GF36hK+rW2XGI7xAoasJK2nREJtJP2J5tQnxS2eqAbQw:NYf0JzM6hz12InSRJjPnxJAZ

Score

10^/10

ardamax discovery persistence

Malware Config

Targets

- Target
  
  JaffaCakes118_b1fee1a0a26a8b490df859f74e4da284
- Size
  
  286KB
- MD5
  
  b1fee1a0a26a8b490df859f74e4da284
- SHA1
  
  9deef453906d6e30d345534236d9bad705fe1043
- SHA256
  
  77f81037ce80d418a67b2bc86584bb33cec4b49cc7a6810f4a0036e08ff7eee7
- SHA512
  
  63d1762c71cb406d63fe1b30f6d33228f561ece65cae089f7be303252829dddf2d46873c3d57d5fae97af467183cb97b598f96666f4ce04b4defd6d569cfe622
- SSDEEP
  
  3072:dXYe7o0Jz5GF36hK+rW2XGI7xAoasJK2nREJtJP2J5tQnxS2eqAbQw:NYf0JzM6hz12InSRJjPnxJAZ
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence