ardamax | dd95ff1cd98b08e9c099e668053ce125c5feed1820d8e1b1f03b422010417b00

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-02-2025 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
Size

417KB
MD5

c69a4d5254922580b97027536e71354f
SHA1

65af75ea166bfeb08774967e4aa61dc1810e90f2
SHA256

dd95ff1cd98b08e9c099e668053ce125c5feed1820d8e1b1f03b422010417b00
SHA512

c86b4bc19816f700c4ba01521b227b5651c1dd93960dce1902b1cb6aca668ff71cf88a33ae22cfeb47020d87398cdc18e6563b78a6cfd922f71b8f48c7a5fcbf
SSDEEP

6144:j8PoYDUEeS6nca0WPwduwuh/u/mZpZg0a6itWkJZpVpBpeFTBjzP0UPQ4KNICn8e:3YUS2hVEuXwb6iI2lDpeFtzP0riCCg

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000017525-12.dat	family_ardamax

Executes dropped EXE 1 IoCs

pid	Process
1748	HTV.exe

Loads dropped DLL 13 IoCs

pid	Process
2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
1748	HTV.exe
1748	HTV.exe
1748	HTV.exe
1748	HTV.exe
2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
1748	HTV.exe
1748	HTV.exe
828	IEXPLORE.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HTV Agent = "C:\\Program Files (x86)\\HTV\\HTV.exe"	HTV.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HTV\HTV.exe	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\HTV.006	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\HTV.007	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\HTV.004	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\qs.html	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\HTV.chm	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\HTV.003	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\AKV.exe	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\tray.gif	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\menu.gif	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\Uninstall.exe	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
File created	C:\Program Files (x86)\HTV\HTV.001	HTV.exe
File opened for modification	C:\Program Files (x86)\HTV	HTV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HTV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x0005000000019423-177.dat	nsis_installer_1

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004bc587fb5f1484ba2da63f2bed4685a00000000020000000000106600000001000020000000b7843c2021a0c10896f2ce560ed268f7aa9f040844100b6a361da635a0a2747e000000000e8000000002000020000000e0d3897d5257b5d0605851ef7fa0f7329a214c0319e500696f2064d5d0bba6ff900000007b5a56225ada7f94350d15f77a680483bb41d9f65355714fb3691647bc72c85ee371ad09713a5bc41ed0a6f1d3e096323cc5ee0c57f857acbae107f63446ff7cc98341e8df149c2dc4d62d3015c5865c3a761177f91aac2cdc3c198f8f14e51f38b78daf4f36605b8ee2be0c36f1f3eb230995fc444aa446769d0b104e66905c7b071c5edaf9df896cca01f8a4aa6e08400000006f128906b4fb0bb8cb1d2803af18b41d47272b801e0e4b7eb95c5fd0e2cc00815a0231f0982b9c47ed6b61676896f847b683a967ea10760d86a205b8e755ee2a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "445300961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFE11B01-E732-11EF-846E-46BBF83CD43C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ff6da43f7bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000004bc587fb5f1484ba2da63f2bed4685a000000000200000000001066000000010000200000009048f4bf230c10c8f06a62f582a77174cc654c6bc5af3bc696ad04ac26adcdf9000000000e80000000020000200000008ced68173e27f3ccace2c543d6a52731441d5f81a03d51682df998b1c26c1d83200000008926ca5acb8ed0ad0207577b0048a6c5cbbd79b76c231ea5704f1cb280f5146d400000007226ce262c716c88b9511548d6843d7b81be4b1102508ebd2932130eab47bfaf27a75301af490d9575ffbd5a53e68f4b94c1116c9942250e9627d14db69728d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1748	HTV.exe
Token: SeIncBasePriorityPrivilege	1748	HTV.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1748	HTV.exe
1964	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1748	HTV.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1748	HTV.exe
1748	HTV.exe
1748	HTV.exe
1748	HTV.exe
1964	iexplore.exe
1964	iexplore.exe
828	IEXPLORE.EXE
828	IEXPLORE.EXE
828	IEXPLORE.EXE
828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1748	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	30
PID 2180 wrote to memory of 1748	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	30
PID 2180 wrote to memory of 1748	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	30
PID 2180 wrote to memory of 1748	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	30
PID 2180 wrote to memory of 1748	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	30
PID 2180 wrote to memory of 1748	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	30
PID 2180 wrote to memory of 1748	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	30
PID 2180 wrote to memory of 1964	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	31
PID 2180 wrote to memory of 1964	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	31
PID 2180 wrote to memory of 1964	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	31
PID 2180 wrote to memory of 1964	2180	JaffaCakes118_c69a4d5254922580b97027536e71354f.exe	31
PID 1964 wrote to memory of 828	1964	iexplore.exe	32
PID 1964 wrote to memory of 828	1964	iexplore.exe	32
PID 1964 wrote to memory of 828	1964	iexplore.exe	32
PID 1964 wrote to memory of 828	1964	iexplore.exe	32
PID 1964 wrote to memory of 828	1964	iexplore.exe	32
PID 1964 wrote to memory of 828	1964	iexplore.exe	32
PID 1964 wrote to memory of 828	1964	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c69a4d5254922580b97027536e71354f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c69a4d5254922580b97027536e71354f.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\HTV\HTV.exe
  "C:\Program Files (x86)\HTV\HTV.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files (x86)\HTV\qs.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\HTV\HTV.003

Filesize
4KB

MD5
d9e02f226fc338d14df200ba9a700625

SHA1
414f134a16a309b31e418ed9e08c0c48aaf6e2bc

SHA256
8165757efb79acceb9fd0bfae6b2c19b8f087cc0461abb17941d460dbdf2e260

SHA512
13c73381602fe2593312d41ab4bc5cd5f922ac651f9e71e3fe3c58e7f0c5c73ecc9d79d61ec46f33a0a81cf73373421eeb510bd99650c0f53af30974ed61b8ca

Download Submit
C:\Program Files (x86)\HTV\HTV.004

Filesize
14KB

MD5
661aab4571bea11f40a403b154d6dba8

SHA1
731266406f6458c99bc8c1a9b3d3b7eb0d0eac6f

SHA256
580e5897b0cd5ec956020f2d482dc953b57817bc83b2dfac72574e1e33c18412

SHA512
b3cf1713f972839afded4b9760b615821d237d6fbab4b6215e5dc6aa964544f1d16ef9dc08f8d58e369cd91f56b3a6e06b15587b1ece4c680f3b2f98f6c2879d

Download Submit
C:\Program Files (x86)\HTV\HTV.006

Filesize
7KB

MD5
32dd7b4bc8b6f290b0ece3cc1c011c96

SHA1
b979683868b399c6a6204ebaed9fc9c784a0429a

SHA256
6dcce9bbba5c2de47eea3abf7597a9c4fb2e4d358efc3752fa65c169cccfa2a1

SHA512
9e0d720799fe816f7d09c8a722b762203b6f12a8625c1c93cd640219ecc35969bd641b4d9e6dc04ab6f95ceb73235a438eb7d48ee9402118db3618b5760551ea

Download Submit
C:\Program Files (x86)\HTV\HTV.007

Filesize
5KB

MD5
e8155b68775ed29590e14df80fdc0e9f

SHA1
ed449da02e648a524004c265f3c37496d2f07f1f

SHA256
b39ba894b0a9a3201461ddd9ee9b297928e793dff221a47f019e75c11df631f3

SHA512
b14e00c46cf9bed0aca0f85775f624ff064f2d2afe1fa68b61bee5729db73cf9a8eced669c52d7cbb9504ff1b369a9a16a0f36c71a70c13c0bd1eaf5e07ccc11

Download Submit
C:\Program Files (x86)\HTV\HTV.chm

Filesize
33KB

MD5
14d48e19bff3bfc93a44a4af777fa8a7

SHA1
ccb4ef17fef63576f484618ccda0764928338b22

SHA256
c485d51d0bb639d7bfdfb447337171af13cff1ad9c3e344e55395a7c17e1e1c1

SHA512
11d4e09364b4e496e93b760708f1a403c3a39016d79e801cfb78e1adcf53dfac8ac6e7187d9faa6c4baf5bc008cbc2e8c56e636d8a8fc41bd90543f78f33238d

Download Submit
C:\Program Files (x86)\HTV\Uninstall.exe

Filesize
44KB

MD5
83cac9da65204dca68d957c5731a7059

SHA1
0291f20c8144494e9eb06b818bed447afee91f09

SHA256
9704a03d01c430189525b18b519d77337e230ccd09ca37d2ee1a25a38f5cec0f

SHA512
4be4fc5cfd21ba4affff87ca1698ba63a62a2d899538ba6034e71a2451d63f545b4e29f8fd5875e0339f97eca360b46fac85d7ca26c7e37a8ea4b3ca65457673

Download Submit
C:\Program Files (x86)\HTV\menu.gif

Filesize
22KB

MD5
20fe009bce33b78dd40b48bc5f8accc6

SHA1
cd614d9b9e088eecb7e63722f61a39a0cf0ec196

SHA256
979c4b395172a53794b18d996df95c75c68d70ec3573aba66cdfe28c8d1cf0eb

SHA512
f6be54be78bfdf770c7c131c5d108b0b33376886b9b4a66598e2c92543a2e83ffafdaea36b9d749784a978d4327cdf52ce0ac6feb9a28d683162b0b3f2f40a37

Download Submit
C:\Program Files (x86)\HTV\qs.html

Filesize
1KB

MD5
40d00fa24b9cc44fbf2d724842808473

SHA1
c0852aa2fb916c051652a8b2142ffb9d8c7ac87a

SHA256
35b0f1bb808e1623ad534fbc1e72cea25ac28f71340e9c543f01d1bfdd094035

SHA512
9eb750e08ca9750988290626ae8ed32a2ecfa7c8ca021b3e26b3da0a94de952b991a9a6a0ad5729d7d5ccf7b3b36fb36fd24047f705d0468ad04908ba8a7154c

Download Submit
C:\Program Files (x86)\HTV\tray.gif

Filesize
7KB

MD5
0ac69330c3b9181b8a109fddb91fa128

SHA1
ef9698ccce041ce8ba3f4af37d0c2b577f19b375

SHA256
e675fecb791ed568aae7f1c24b159f7c0f7e23fe8a7ce76f72b3dd1a4ac00e9d

SHA512
3a74c04baf3e1e842c0a2568a6480e4ece05baef31171397763de638c6e5b0d26255cf1d7802ea53c355563b8e4b600d24d04afb5168fbc54f66414445327749

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ardamax Keylogger\Ardamax Keylogger.lnk

Filesize
954B

MD5
998d1129c729c25b2936721c218d131f

SHA1
5f71c8b35c04522c44446b9fe28c00621d5ef333

SHA256
5c09b09e7e7316030e9bff6287d850dd0d32ceb3b74948a3c576360f2ca33875

SHA512
ae62515d6c1238d5392bc024e393d10a53de049a4b11755aeec15c2da87096ed16e121a6f124f8f6f1bf48a7366832ad410a7c52954acd97f7cf5e3495b08796

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ardamax Keylogger\Help.lnk

Filesize
910B

MD5
dc254bd424b9f70d1f67285e4e402179

SHA1
8c14d51faccdc9c4b96bf5a11856abe00ce0989b

SHA256
75850d32fe5c55e26d8b64343cbe10c9e7eb1f0483ac00e2a9d183d5e641d2ac

SHA512
cf6c1b00db1cbe4056b9e77538407105570260a9b2b60c24cc674bdd39c915b26a35f49af98f4e145e0c343e0a83f72f5e80f3c345b16de0b09bbc572f756354

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ardamax Keylogger\Log Viewer.lnk

Filesize
968B

MD5
7f795f8b7b4d1ab682ee0e6101bbdae3

SHA1
c600a1e80dd88277dd63f82edb8011f36748ccc0

SHA256
5bbfcf266b3edacf73f821cdaad5c1508fe4b5f7670eb87d21b2c9b0b767b4bc

SHA512
bfad786679405d68e9a86506c2bf5b9e63cd05f8cc642bb1567744e19e03eeaf33ffd8c77706b9bb571713d72364b19d5617dd24304d0ce7d734593b78afc3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ecf2216daa7ef4717cc86cc170a9a25

SHA1
5b12d3c32aa3eea2b5cb1145179591a4d7b958c3

SHA256
fd5ef9fc34cae9557e9654d00d1aa7690414540241977a379da688012473ce81

SHA512
e2a377f7c1f839dd185fbb05efe481d08091b69cd5abe025096b65a49b6e037d5d12a5ae81f60367947cee820645ed51bd22e97bf46e70c09cef81b4dcf9895d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c32abaf0e8721d20798bde616679bece

SHA1
8a6391e82f6c05c767042dc8d226a4bb11297e65

SHA256
bc634dff62bb6f6d79859ea8b3a242da60edcbd1c9ae191fb694a880dd6617bb

SHA512
11fe261761d56358f08b22e071b854b25db7efa27721cbe24a3d74d49163068bac99c95d9518f1149fa6308d9d0f27832dc4f05c603d647272a4bfa690062a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c85d1c387dd15eefc99688fd6faa742

SHA1
d2268a6388f65716359e954940acab3f59d0f745

SHA256
41279b43b24649ba3fc50b810feac04f2a6bd315b37a63e214165ec3b178e1b8

SHA512
2173753a0cd2949e8334a03502ffc07adbac0c57252c530538fe3a8bf515ac342871f9fe9dae649bd99d2c63c720cca92f4e0ce2bbaf9f7005a77fff94c7d037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f6f6162c3a74d010c6895bd6cb67bf4

SHA1
2e469f2e5675b1bdfd00bc00cf2ace1341f8ae01

SHA256
a55bb3af8ec08ddbac6edc2dc66a35b2f5d8779a7502391c576dfc9fe4d5ed75

SHA512
9d2c9683cd4b792f0d53e27c23059cbb9fae2b2006b92068745c1b799aaa9ed1ee12e0f8cad09dc5abcb698212fd7ba0afe874a63951976f813a5893eed90233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9278aa6c58588ec0ef8af040c99f9c6

SHA1
57f33cb46bb3a1b0f92f91b3eeac3a2d9065cf24

SHA256
b3acd37e026dad9124091fdd896d7e241187b48522d2fe396da6e8998efbf5fb

SHA512
823267a2a5e737adcb07e62fb0d98f23661ac03a9d399cb7da2cfe64f4efa7d966344a0936cae142388a7476f126ea59413df24795bb9fbd7c5d3dc41209ae0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E6D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E8F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF9C.tmp\ioSpecial.ini

Filesize
735B

MD5
ca4fb82ffa0f2d9c1e2a9e39aed4d079

SHA1
4029befc1906df68784282ab040e2534598211bd

SHA256
752138a105d9025dbd8ccd373c5e53d5df868e8e5427cb620bd4bcdc91c03e93

SHA512
dc312facf63f706e9d76b7cf460802d4e91fd8625624acccaf727781ef430f789a720ae02402f4a4b0bf5eeadb8a27f705b3051be63756da907989487f2547d1

Download Submit
\Program Files (x86)\HTV\AKV.exe

Filesize
393KB

MD5
24781fcca21b8baca869cf2307d7f9f4

SHA1
148ed81fc561c9547ce4203926bf742162b177dd

SHA256
0e0aa9ae7d0ff11c8757768527ca3ae61f56d51cb645e88421d4905db14c5032

SHA512
e2769dc1194a909c9a9fc42faefc5c67c94297eded8cd95c8b4de5f1b5666ddbfd14fb5fdff0811c2840c6e318ff60b80693eaa78be3f7904887aa2122ae5b5a

Download Submit
\Program Files (x86)\HTV\HTV.exe

Filesize
471KB

MD5
3c06bbc025b61d2182ef5573f2852bda

SHA1
ebc1464c00b13fb5b3f80a59c80b595020e1fe7c

SHA256
e7f64e7215284cdeb8ef1eba28733f7aeae7f6977f82809d8de1e76a2e249085

SHA512
9d839ada211b85fc1efb1fe7bb3ce66fcf0e8069221d958234649c2ac5dc0f1bd06f1a016f9c727077af36fb46cac5409be9c8a8201d17f689c6b473aa01acdc

Download Submit
\Users\Admin\AppData\Local\Temp\nsyF9C.tmp\InstallOptions.dll

Filesize
12KB

MD5
b3ebe1cb6bdd529302c121dd4e2e0d00

SHA1
305f022e7e3ef0ae6cdc5f18bd6adc3032f64304

SHA256
5a1696f9892567b3339faf2bf4df5eb1d2d886c49807529028b65f0f493e79b2

SHA512
6f6ea4aec1588bb6f7ab4f8422942ac0acbddb8b916af2ead039b434bec6db4d0bf64deb3b8d6cc33666cabd70024a1208411ab6e0ee10bcf98c47951f8d359a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads