ardamax | 9f14d1c96c84606b063e003bfb086053c5098c4a14339c4fd56b25841e560d6a

Analysis

max time kernel
102s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe
Size

3.0MB
MD5

7dc04aa7babde3fc4ef6b141d3c44eac
SHA1

ac9904daf31fe06c9c318889fa26676c39fbfdea
SHA256

9f14d1c96c84606b063e003bfb086053c5098c4a14339c4fd56b25841e560d6a
SHA512

fecd0c7323c77cc38defe3fe0ca989a13effedb25521d40400e9a07d03db3bbe2e0927f18b01bbdcf3b5f62ec022211937c7771a234450d479c26f88a2ba3e73
SSDEEP

49152:ADxlwVK5e2x4Rnyj2nsPxnj47YuopkquT8mgUcZ7bXyzbt/yXA5+UHLzX6woeSGO:ixlwVK5e2ORnl2xj0YuojugmQZ7LyFyr

Score

10^/10

ardamax discovery keylogger persistence stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax
Ardamax family
ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000024287-12.dat	family_ardamax

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe

Executes dropped EXE 3 IoCs

pid	Process
5964	BKFH.exe
3032	loader.exe
5812	loader.exe

Loads dropped DLL 10 IoCs

pid	Process
404	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe
5964	BKFH.exe
5964	BKFH.exe
5964	BKFH.exe
5812	loader.exe
5812	loader.exe
5812	loader.exe
3032	loader.exe
3032	loader.exe
3032	loader.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BKFH Agent = "C:\\Windows\\SysWOW64\\28463\\BKFH.exe"	BKFH.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\28463\BKFH.001	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe
File created	C:\Windows\SysWOW64\28463\BKFH.006	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe
File created	C:\Windows\SysWOW64\28463\BKFH.007	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe
File created	C:\Windows\SysWOW64\28463\BKFH.exe	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe
File opened for modification	C:\Windows\SysWOW64\28463	BKFH.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 5812	3032	loader.exe	90
PID 3032 set thread context of 5812	3032	loader.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BKFH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\Programmable	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\TypeLib	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\TypeLib\ = "{85C3F8F7-CFCE-4259-87FF-CAB1F4521F6E}"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\Version\ = "1.0"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\ = "AppIdPolicyHelper Class"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\InprocServer32	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\InprocServer32\ = "C:\\Windows\\SysWOW64\\AppIdPolicyEngineApi.dll"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\InprocServer32\ThreadingModel = "Apartment"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{57334274-973C-23D8-35A6-EA4555A9EEC6}\Version	loader.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: 33	5964	BKFH.exe
Token: SeIncBasePriorityPrivilege	5964	BKFH.exe
Token: 33	5812	loader.exe
Token: SeIncBasePriorityPrivilege	5812	loader.exe
Token: 33	5812	loader.exe
Token: SeIncBasePriorityPrivilege	5812	loader.exe
Token: SeIncreaseQuotaPrivilege	5812	loader.exe
Token: SeSecurityPrivilege	5812	loader.exe
Token: SeTakeOwnershipPrivilege	5812	loader.exe
Token: SeLoadDriverPrivilege	5812	loader.exe
Token: SeSystemProfilePrivilege	5812	loader.exe
Token: SeSystemtimePrivilege	5812	loader.exe
Token: SeProfSingleProcessPrivilege	5812	loader.exe
Token: SeIncBasePriorityPrivilege	5812	loader.exe
Token: SeCreatePagefilePrivilege	5812	loader.exe
Token: SeShutdownPrivilege	5812	loader.exe
Token: SeDebugPrivilege	5812	loader.exe
Token: SeSystemEnvironmentPrivilege	5812	loader.exe
Token: SeRemoteShutdownPrivilege	5812	loader.exe
Token: SeUndockPrivilege	5812	loader.exe
Token: SeManageVolumePrivilege	5812	loader.exe
Token: 33	5812	loader.exe
Token: 34	5812	loader.exe
Token: 35	5812	loader.exe
Token: 36	5812	loader.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5812	loader.exe
5812	loader.exe
5812	loader.exe
5812	loader.exe
5812	loader.exe
5812	loader.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
5812	loader.exe
5812	loader.exe
5812	loader.exe
5812	loader.exe
5812	loader.exe
5812	loader.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5964	BKFH.exe
5964	BKFH.exe
5964	BKFH.exe
5964	BKFH.exe
5964	BKFH.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 5964	404	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe	88
PID 404 wrote to memory of 5964	404	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe	88
PID 404 wrote to memory of 5964	404	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe	88
PID 404 wrote to memory of 3032	404	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe	89
PID 404 wrote to memory of 3032	404	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe	89
PID 404 wrote to memory of 3032	404	JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe	89
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90
PID 3032 wrote to memory of 5812	3032	loader.exe	90

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7dc04aa7babde3fc4ef6b141d3c44eac.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\SysWOW64\28463\BKFH.exe
  "C:\Windows\system32\28463\BKFH.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5964
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\@43FE.tmp

Filesize
4KB

MD5
908f7f4b0cf93759447afca95cd84aa6

SHA1
d1903a49b211bcb4a460904019ee7441420aa961

SHA256
3e6378164f9dc4148b86c9312b63c5a6b1fabcfebf9557f182d331e9cb32fc23

SHA512
958e0880565b008cdb045d6aba5103f0ba820ac037facf24b78924187a119258e3a8a97de4c3874694962114ef672d41a55feb71b92d5038e7d45bc3d91d6b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader.exe

Filesize
2.8MB

MD5
f5a84b735c3b183e5845cbbddc6b13ad

SHA1
eceec64571370a7997650977fdfb8e9d31a63374

SHA256
3b93b77f9e6b199c41779d627bdecd12360476c4f3c8c6b86f29c9276c439560

SHA512
9a48016f076563f0f9ab19dd52c44a22468ad1cc692ddb798ebc89637963650ea256140b73f1e7b511ed462e0d98c587e9c484aa36a0649c3d9ae0d3c1b644a1

Download Submit
C:\Windows\SysWOW64\28463\AKV.exe

Filesize
393KB

MD5
b0b09699ea39c0107af1c0833f07c054

SHA1
b730e2fb0bda9bf4a1b1f8768a00838e3ca9dcc1

SHA256
be63e3b5a6c3fbec11a737332d4e0040a23cc2d17182b4bc5e7d5dd41d930ee1

SHA512
55430e53058964961808f37d738c31f1502c3ec4a14b0296bef7bad22e468734bcd119eedba14cc87894d4acc81c9266572aff9919b18bd584823c47fa149796

Download Submit
C:\Windows\SysWOW64\28463\BKFH.001

Filesize
500B

MD5
1e64e1ad030d2591bd3d036785a5d4ef

SHA1
f8a638c732e22dadb2c61f11a0aada3c3e3f2946

SHA256
335ab77a7390638edd4db07b096beeb32ac9358f168225b767191ef74d2dc40a

SHA512
b29ea9e4380f355e96d449c3062798ea78c25bb65c1efdd30c697db3e02646bd3da30e483086bfde987925813e49294c80533808eb8e96af4b8fa4daeb2d6275

Download Submit
C:\Windows\SysWOW64\28463\BKFH.006

Filesize
7KB

MD5
e0fcfa7cad88d1a8a462cee6b06cf668

SHA1
a7e49078517abc929a6da261df06556c8f5a8cf0

SHA256
340ff9f7f784e299030abb9982c88547e67251a6cca07d30ca8073d01a2840c4

SHA512
430fd640432769047de7bb4432f710193855a5121fe5944ef07f6b68749608312e7c22b29834967d429637fc9b285671cd10bbc9e1cfb43654695a206ba9cf82

Download Submit
C:\Windows\SysWOW64\28463\BKFH.007

Filesize
5KB

MD5
ca72cd485d116033f1b776903ce7ee0a

SHA1
85b0b73a75b0498f56200dd1a5cf0de5371e42a3

SHA256
e583532d6b4d8cfc1def5e550674e9e1a4eef2a107adacddf729fddac64f49c4

SHA512
8dbf6920af64aac6a80c3da4a567473dc20c8d4e24078f7e66bb5aa1a08641e5081b0a1ee05f82fb1dd14218b62572c198ff39b1add5f19893008b3d8e54538f

Download Submit
C:\Windows\SysWOW64\28463\BKFH.exe

Filesize
472KB

MD5
7ca78f42e7c88f01fb7fd88321b283ff

SHA1
8f6fb4e3f5b696cac4fd54490d5f8c1862d0bb6b

SHA256
2354f408b272232ea4bb74d17d22a4332b97f1003fb9bace174a9811f2b41729

SHA512
06e822f04a4657b492a485b5a542e5c8400060abf7e71020d17965fee11f1f7c0807e32b5f9426a4fb9b4d7dd05a68ae871e5fef0807e24204351ebe569eb4ca

Download Submit
memory/3032-64-0x0000000000400000-0x0000000000A4A000-memory.dmp

Filesize
6.3MB

Download
memory/3032-32-0x0000000000400000-0x0000000000A4A000-memory.dmp

Filesize
6.3MB

Download
memory/5812-40-0x0000000002670000-0x0000000002704000-memory.dmp

Filesize
592KB

Download
memory/5812-57-0x0000000002670000-0x0000000002704000-memory.dmp

Filesize
592KB

Download
memory/5812-63-0x0000000002670000-0x0000000002704000-memory.dmp

Filesize
592KB

Download
memory/5812-49-0x0000000000400000-0x0000000000A4A000-memory.dmp

Filesize
6.3MB

Download
memory/5812-53-0x0000000002A70000-0x0000000002A90000-memory.dmp

Filesize
128KB

Download
memory/5812-52-0x0000000000400000-0x0000000000A4A000-memory.dmp

Filesize
6.3MB

Download
memory/5812-51-0x0000000000400000-0x0000000000A4A000-memory.dmp

Filesize
6.3MB

Download
memory/5812-39-0x0000000000400000-0x0000000000A4A000-memory.dmp

Filesize
6.3MB

Download
memory/5812-56-0x0000000000400000-0x0000000000A4A000-memory.dmp

Filesize
6.3MB

Download
memory/5812-54-0x0000000000400000-0x0000000000A4A000-memory.dmp

Filesize
6.3MB

Download
memory/5812-58-0x0000000002670000-0x0000000002704000-memory.dmp

Filesize
592KB

Download
memory/5812-59-0x0000000002670000-0x0000000002704000-memory.dmp

Filesize
592KB

Download
memory/5964-48-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/5964-26-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads