Analysis
-
max time kernel
91s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
20-02-2025 00:55
General
-
Target
JaffaCakes118_08b39db6c2a5199ae0efa34f5c731640.exe
-
Size
800KB
-
MD5
08b39db6c2a5199ae0efa34f5c731640
-
SHA1
5530b023c441b87830fdb26ac62f5c6967595888
-
SHA256
ca337b131437beaa4a076b55300b5539d3099346c91c01641f8154db09fc046c
-
SHA512
56005fc6c86e5c0bf9870e59bf4988e7cf41684d2bf949fd1983aaf79da3169887a014cbfcc401d1fb027049351719b9018056e06a1210126c743df4f468933c
-
SSDEEP
24576:WOXjVYkHUom27yO7MzIrfekb3fgMC4yTm9S:WiVjgrkbfQSo
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 40 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08b39db6c2a5199ae0efa34f5c731640.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_08b39db6c2a5199ae0efa34f5c731640.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\WMAT.exe"C:\Windows\system32\28463\WMAT.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 11443⤵
- Loads dropped DLL
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\28463\WMAT.exe > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2204 -ip 22041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f1cf9fcbddeadabb738de497ffefdced
SHA17385a7c87e245da89cc5ef8f9295678c1566f25d
SHA256086083bc73b14286f9c3c29df8b8dc6f014d8b084267fbaeee0af56344d1f779
SHA5123a3b9d279b4c131ef3f358e0163f60ec9e60160a2cc45488adb915fea6642f3df5d35da2ccb6983d790401d237fbc808829f42c42ef958e7a0eac98fc33bb3f6
-
Filesize
457KB
MD5d2366486acd1a1e7512b0024ea3c7bdb
SHA1c9a4948a2902c899fbc8f51755a745b220f26265
SHA2567142651f09fa4a93574850904e21ac8c99dd4e4aff728e2ba68188a459f53461
SHA51250c77906a2175ab488198e2d240d6d8178a189369fc93ff5099e59e1114f8ac1b5496e639d128a60626403b2303a60c51d6f8abae886d90ec2eef03617eeabd5
-
Filesize
436B
MD5f213c2ef2616795e5ffb22aa1fd67377
SHA15e789f0fb782285214655bc88d9de3a8cfff7c29
SHA256b05f971e971d01fb5e0c6e21dbfb86f729477a51b136deab54a8ba23cfa449d0
SHA512f5bf1822700e61408c9420802b313279dfaf395c251bedc02cccf7e155bb2a26f3270618b56d724fe5e021f627cf2de3736be8df037442f4dc89ab12cfd02827
-
Filesize
8KB
MD531854a50b294dd312eb7fa9eb1c99537
SHA1e0b1682a001e15d0e0e1c1ca732cafb5c80b3160
SHA2562fe2d55aae2deef38a37c9679d74ecf05699d6919760794f69583b43b7fe308c
SHA5120482a4981ba242d4e931bd8b9eb5d606492cffb7609fb69fb349ed19c7a9e36a7e240e5ebe759505d253c5e72fb771612a76419c36fb035987a166569a5111c2
-
Filesize
5KB
MD5603451f504bedb28c3a7bae4c89abf24
SHA1cbfe12186b54663f60663c349739c7a49950c44e
SHA256e4d6577ea390274308877284b6d0cd6672aeb0e76c9c9847ac59c0964f050d13
SHA512136e28e288b3ce26b37c82b078a3440e3232c0f874d7d33e8e6fb6eadfd0024b9009448500c716523b81f142fa3bebf7d11f1dd3e8e6143867b06335eb5f9612
-
Filesize
648KB
MD5ce568bcaf7285124f764aff92f5079d4
SHA1886f698e2239cf615f12b503853a5fa28c53aefc
SHA25659d7d6de8a9e2d5535703d22c36888889530fd011d7f71cf034e93e36e7527af
SHA5129f6e3496930cb5dd9c9403acc865bc94f63f64af49a27ffeedbc9d9082d50bff4a7a772bb98d4a2719f0ecae144393de9cc273ba83ae00abe347b0be0d7c9866
-
Filesize
106B
MD5639d75ab6799987dff4f0cf79fa70c76
SHA1be2678476d07f78bb81e8813c9ee2bfff7cc7efb
SHA256fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98
SHA5124b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
892KB