Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
20-02-2025 20:16
General
-
Target
JaffaCakes118_0df39b6680451ee6693861d3c2ceaa4f.exe
-
Size
724KB
-
MD5
0df39b6680451ee6693861d3c2ceaa4f
-
SHA1
14ba929dbfee8c473b8915568cd1574bed632930
-
SHA256
56aac3c96c719b13b316108ffb2eb24b5c39e2f4b669c7cad0146c0991fae19e
-
SHA512
728bb97c219183d70846a2b1086770ab68add62ef0cbf4ca870655f40a4f2d87b4c903724f1111b323e954a92a359efd88c1c5fa88285c6fab711cc2d910de90
-
SSDEEP
12288:W5Zjyq85p5fMZX9BxN7nV/OQQBVXOVv4qx9du5FZL1E4wwPM5Dp9K:8Zjyq85pmB3n4tgDdu5FZLG4m5Dp9K
Malware Config
Extracted
Protocol: ftp- Host:
milenium.50webs.com - Port:
21 - Username:
reinaldo - Password:
8663534
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 29 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0df39b6680451ee6693861d3c2ceaa4f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0df39b6680451ee6693861d3c2ceaa4f.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\SysWOW64\666\Detallado.exe"C:\WINDOWS\system32\666\Detallado.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD527c90d4d9b049f4cd00f32ed1d2e5baf
SHA1338a3ea8f1e929d8916ece9b6e91e697eb562550
SHA256172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb
SHA512d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae
-
Filesize
2KB
MD54260a10512b79a5375c9bd2fdc785edc
SHA10e28874464c7a1b46e3a9ea2c4ed4279508573fc
SHA256f05b64db42ffd8fd9b57e4f68704023667eaa6eadb492babf328301d283de763
SHA512517cd061fa5478ef7a0b5f2a2079c6410cb667d45bdbb5bf7c4ea20fadbe485ac161e0deb11e44bf0ae8790d304d5ee1a7b6d1efdfa9eca1b7424ea79f50fb6a
-
Filesize
1KB
MD514c86754feda895ecfe8ceb08da17b60
SHA133dc79889dc6a2ed745f6a61b5065df14d24a05f
SHA256b577f25dc347bba5b06c52f73e50c8e1343f7bc481bcaac49ea3a793657239ca
SHA51276e44bd96391b8620b2de489278acf8753312697ac3829872adc12f09b9169e405a361a93dfaa4fc8e3d7541bf50a43a6197c023130d47eefe9297d6a2b11bf0
-
Filesize
650KB
MD52e94314b7e3864006b242799353df3ec
SHA156f1009a2e98360e4b469e8f0e1ba3f5b8e7124e
SHA2567813d7402dcbfe25abf5f35f46c7a4d417e690d0dd6441d1662eef98d5ad931d
SHA512b75b4bed85b55d6aa15ad1f52f313f54d134f7e17f816d51b9387b7991d665c7493457557b746845f4d3b1d28d6994cdd162e05b6526a95cae5ec2fcbcbc5bb5
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
892KB