ardamax | f34ed206342864c5600f951a66e6e488415f692ef493530f51f9e5d2f71e1c57 | Triage

Sharing

General

Target

JaffaCakes118_fec1f4f1d500dd68b7f0b57ef8ffc370
Size

239KB
Sample

250216-c7b69axrbk
MD5

fec1f4f1d500dd68b7f0b57ef8ffc370
SHA1

c840ba18dd4b8e6b2df3d3f9e03cf02e369839ef
SHA256

f34ed206342864c5600f951a66e6e488415f692ef493530f51f9e5d2f71e1c57
SHA512

7ed09b9ce40e04092ba23a8e80d8c08a2d996ff8c9357ff2fc16492e6995fcacceeccf01a5cd29d2dd0ea5bdefe47e6597982bee58c86137301f72baf0d42d76
SSDEEP

6144:Jo39kDP3P1NYfejZ+4IbAIID5vIGi4MAG:c9e1CmjZ+40nZB

Score

10^/10

ardamax discovery persistence

Malware Config

Targets

- Target
  
  JaffaCakes118_fec1f4f1d500dd68b7f0b57ef8ffc370
- Size
  
  239KB
- MD5
  
  fec1f4f1d500dd68b7f0b57ef8ffc370
- SHA1
  
  c840ba18dd4b8e6b2df3d3f9e03cf02e369839ef
- SHA256
  
  f34ed206342864c5600f951a66e6e488415f692ef493530f51f9e5d2f71e1c57
- SHA512
  
  7ed09b9ce40e04092ba23a8e80d8c08a2d996ff8c9357ff2fc16492e6995fcacceeccf01a5cd29d2dd0ea5bdefe47e6597982bee58c86137301f72baf0d42d76
- SSDEEP
  
  6144:Jo39kDP3P1NYfejZ+4IbAIID5vIGi4MAG:c9e1CmjZ+40nZB
Score

8^/10

discovery persistence
- Downloads MZ/PE file
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence