Analysis
-
max time kernel
141s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
21-02-2025 18:23
General
-
Target
JaffaCakes118_146cee63d2e8985c1dad99791b0835c1.exe
-
Size
1019KB
-
MD5
146cee63d2e8985c1dad99791b0835c1
-
SHA1
e5dbdc51abbdd9515e48ea263be99f81a18797ee
-
SHA256
fa50081f6416668ab65e3a9b200aedb80776e8ad18d8a9eeba7b8750216126f1
-
SHA512
e8146c89fe032f59532947fb745e25c78e3d79abda4c12c6d988a95f79ee5d581c1acee179e877c019e706d412ae4b22238208dade68947b113436fc431854e9
-
SSDEEP
24576:CTP2F99HPBWHc1OtA4+TVBDvz8eFvPcss3d+OUCxb9:/Qc0tKrzBpAt+cZ
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 36 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_146cee63d2e8985c1dad99791b0835c1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_146cee63d2e8985c1dad99791b0835c1.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\LJKO.exe"C:\Windows\system32\28463\LJKO.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\_ALERTA_NUEVA_DROGA.pps" /ou ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5ccf39f70a662f70e7cae4cfc81255c44
SHA100177d41252c2a5322be8e54567a845217072e2c
SHA2564c9cca81f2f2d91b636c0ec747e96821749788368c48981bf04accfeb5c2e5d0
SHA5122cc006d3bd6af737f31707b457caaa267ee1361cfd0afab0be8b74be8587d02b20909962d138e137fe79252e0d112bd3be091a98ba50863520b5bbf21bb9501d
-
Filesize
277KB
MD58cdfba9bbc04072d0ced1497ac4f4509
SHA1f778af20afe510b79bb7b63d69e18249ef55604f
SHA2569610bfa6d021b735b56e556e600d2ad09b58a1b5db3bc312ad6197592f5417b0
SHA5126b1c2f5d62308d77ff2ef22db9cfa5c4da8bd6566726aac65b61a2526c9c5641115e3b42f753d7a22d2000bd5648d5abb5726824ebf04a8dd903e5081d2df75b
-
Filesize
457KB
MD5828586f5f9fd7e6bd99401fe7cece954
SHA18eb70f4af2cec3c3dd3ec1491913369e99b7b874
SHA25602b8379b1838ea70f7f17e0785aaaedb7c721d9b6e262577723bba9492748d0c
SHA51216b64be59cf9ae403fb3b7e1fc8da98cb2a5db84aef0e352910172796ecf96dcf86a7e16afe78fa7e22b7b6948e8a1fa027da7161d5a0ad98e76175d764ed6a7
-
Filesize
428B
MD59b04d804133c8a88c03470c66ddcfb16
SHA16480cc4f4039c7ee22a5ddf9ebb1c6d958c7c219
SHA2560c58bfc5978632232267aa0667057ff2750c036066265667e983c69b625e1fdf
SHA51229d43b625d97613dd5508c9b7460d06a4b2c9dddd80ae9e860fea80549d58869bf4b17e7c0691b4cbde1873decb448483cfd20f6b24a4693083b7e77cfce73ce
-
Filesize
8KB
MD569db8c925f2dd8136d956a086ed1ee41
SHA19d0f653cc7ab881eb45fe93490a9c096f2dec6cf
SHA256984da5476c2c69a779bc99d0901569347cc605a36499e2284706cda3ed6e13f3
SHA512fa5cedd539dca3631511488aea8bcb7821db1d53452c1b61ee663cb5700bb9919b092593a7f5eb7a3c3a75f801b2980f817de4a66bf8aa51093ced4b30ffd068
-
Filesize
5KB
MD59e9da4c851850726c789bb4b94a41bb3
SHA11e2fd71f1d1a3ac15d3c820d8459635cd775cf24
SHA25694f6502a4e94de0301ae07befd63767a4de35d9b2d2d00687a3130e883ab1963
SHA5124c60e951056c5773d769a9c88245fc4a597949deb72a1a7546991488e85ffc4ff2a34840ad227595bcdc105cf187207721b57c457ac832ee0159dd0e1d9be063
-
Filesize
648KB
MD5c5ca2c96edc99cf9edf0f861d784209a
SHA16cb654b3eb20c85224a4849c4cc30012cabbdbaa
SHA2560ca27dfe22971bfb19c7f3d6fe03cd398816a88fc50943ba9821fa6b91be7807
SHA512aeb36bbbf68c7b733ddd856f8f0cdd9548ff597843a22611757c98f69a589035410fecfa692bb83c740823ddae6432d3be5cb66f4309a9d0f5fedeb7b017ff36
-
Filesize
106B
MD5639d75ab6799987dff4f0cf79fa70c76
SHA1be2678476d07f78bb81e8813c9ee2bfff7cc7efb
SHA256fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98
SHA5124b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
360KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
892KB