Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
20-02-2025 12:51
General
-
Target
JaffaCakes118_0beafefbcce2420c65a29115df6a59b0.exe
-
Size
800KB
-
MD5
0beafefbcce2420c65a29115df6a59b0
-
SHA1
76d5676c3ff23a65e5930612211898065427ea3a
-
SHA256
f0b91cd0711855a8ccabb024d1e4a0f84d187975cc063b21780c7c60f8cef240
-
SHA512
11ea9c0d74a8150acfcfd8fc810617a672df82af209355e6837cc0be6336fb27e339bdd1ddedc32789ec7894ba39503c0fd1b05d844addb6eb1830f64d4156e6
-
SSDEEP
12288:IEtkFVViAH/JfNp7/PfwfkB+Mrtf/ExYjrgq8W3aBcR6y1mQmlfGncWdm2jximcW:GYIJfb/Pr7JcYjrX73pR6y1mMndm2Xx
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 40 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0beafefbcce2420c65a29115df6a59b0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0beafefbcce2420c65a29115df6a59b0.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\EQPN.exe"C:\Windows\system32\28463\EQPN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5557e0039dc13a0453af7ca9373a0d301
SHA150efb19b1b1eddd10ddb4c2ff23d18cccba92dfe
SHA25654850e4c8644c042b15dab73a15135105ff84a240d26d1476c8b80d176a341fc
SHA512d96fdc89ddbcd8459966c9548d3243a0fa319f8be2f418b4e17f313fb3f86d32dd7f254a035641f35e35ed849832773c0d1fe34ff362761309c64e959c025a98
-
Filesize
457KB
MD5bf3f029b48698972471caaa7e9cea759
SHA1304ef8b5c72bf95e5d3efa18e5587c6d9cacfd15
SHA2562f55fb7d6318f940c208276c25d63d7a7a8406da1c82f51305f1ce6381ac1aa5
SHA5120fcc2c42ba1cf816152f1e116789c615956024b58a06a985c79ac9b71fa10dc232a5c4210f18f4d3a70730454cbdc2b3da56d24e4da207d58ce2446424b68d00
-
Filesize
362B
MD5e915e398f7d2eaaf8da28c67f923b8c9
SHA15665aec7604d023ea5d8aca50209df40660dbdbc
SHA2563b4c59fee8e89f81fee6a2760fb2f751247c2d39c18e7fd97c1143ba2f9e2f4a
SHA5122892b49b912f20a259d8ae879070f0b3d901776e1daa5fab971d35d1913a048c452e1cea9e537be2ba29f8e08fae8cdac61c82da1d23f62a00debc0f8d7b8c55
-
Filesize
8KB
MD55153b016d36928c296131c5c8e669446
SHA1c444f61a2dc49ede6a2325f26d76af66de5989d2
SHA2564c52ec0d5d4cad21ed134af76f64c3cb44b826594641f44487e4625f5bc96f59
SHA512c9084ff30f1f023b1f9cd00dc66cdbf846e95993093163c3e71a13535ccfc79d59be5b28a78ccfa6b0a82389b08b157676d71a9ccca2c170369080feac386f09
-
Filesize
5KB
MD580bbc7ace13d97396bd7b1abbaf4008b
SHA1d013c0def603915675b1e0ce5877d413cdaf6523
SHA25618dbfb27d4b10501e8426db1a78df8247f6570656d183f78b061d7db4c7865ae
SHA512bc7afd0e730f432852d374812827077574181928aa97c25d8170ce1b766677383360bf2bb21afc51e8168eb3f6539ce8499c4002d86190f27d4836da3f907919
-
Filesize
648KB
MD55530832fa82582288ce640f73a4915a0
SHA1c40673ed59a61dd3b39f8ed6d0e1345838d98e44
SHA2566f7daff3caf7f24a00e08e4ed414b4d23e13d2cac4657ad7a071d9cbeb42cb88
SHA512ee2a2dc3c85a13b39f15a276f842afab8d341aacb457c1750b8bf0fa46b03a3bfabeff5be6439f3edf2c428d504ecabf07a399ebbdb09a75693309b55903775c
-
Filesize
106B
MD561cfbaa287e6cc38c70b1f64d7f72569
SHA142c5fa65fd14ca73cae62c2a3b9c23559db33078
SHA256271840d5892781b401517fa4348444f48979416221c3434df3e329f859127904
SHA512d52bb21072322c09876a6570a9f83a2076cbc61cb4b734aaa6021951af093744b4e403f8597dbf353605347499b156391f6b0242dfa9de419c5ce26805ebe0cd
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
892KB