Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
18/03/2025, 13:14
General
-
Target
JaffaCakes118_7fa4e39d15eb30429767d1f9c90c61b5.exe
-
Size
602KB
-
MD5
7fa4e39d15eb30429767d1f9c90c61b5
-
SHA1
3ecfa72f58838504aa6150452b2230cd53770294
-
SHA256
1b900147a0585b4cadf5beff05e68c05f2fa14fc750aedbc5745849fadd5bea9
-
SHA512
4a68c1733be09e861f8098761a7f8be37b506389c39aeffa3c7cf152bfc45253a21413472dc8a398c7c89a757cabbcb8aaf205900a447769d3a0d92691983195
-
SSDEEP
12288:l3TdtLW5WIj1YSSdFx3ovBSXyMzBUWb9lx/9AgHLo8OW+rB8:NDsj1dEnwBcJ9nPx/igrp+q
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax family
-
Ardamax main executable 1 IoCs
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7fa4e39d15eb30429767d1f9c90c61b5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7fa4e39d15eb30429767d1f9c90c61b5.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\28463\svchost.exeC:\Windows\system32\28463\svchost.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c427f41a9eb12166c278da8fed8a0c4a
SHA1e0e1d1c8f6b58675a544f1461997cfc37a2e6c63
SHA256ee74d1ba7e74e916f57ac4134aa5aa6eb7f920e7dae3b4cdb75af9225da616c6
SHA512ea2e49983e04afaa0eec5b28eeed1e9c804326b49933e69962805c10a405cb7dd87061e50355f395e74107cb6ca674d4c8c0000ef13505ec58b1d7dec873aa85
-
Filesize
513KB
MD50c7a714b8e1d2ead2afc90dcc43bbe18
SHA166736613f22771f5da5606ed8c80b572b3f5c103
SHA256800bdf00e09f302a17e22d26dffbea037e3c077ef9f6d1d585c114f079397a9e
SHA51235db0de86c168eb6302dcbaa1e1f9ec96b5a8814e7067e1a7bb682e9f35fc06c51148a08e6f7df1e8caeb2effde555c53966a8922e8fef6b7ce194dc81c984b4
-
Filesize
2B
MD5e0aa021e21dddbd6d8cecec71e9cf564
SHA19ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA256565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
SHA512900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
-
Filesize
96B
MD59ece103c47335f0cc777f1132b8d522f
SHA163afa171c64f86d99db81723e1335e960e85fa43
SHA25669815d4932ddde240ce6b1353305d2fab58ca402e9c478452c8e37ce8a7b2ac9
SHA512b1ac64c71c6338bf0ab33df938128822da680f20d0552edb2edb808f1c75bafb88467412fc8dc60ed8022a1f0c4f3fcbecb69a320ec871b3a766482f32d6eb05
-
Filesize
602KB
MD57fa4e39d15eb30429767d1f9c90c61b5
SHA13ecfa72f58838504aa6150452b2230cd53770294
SHA2561b900147a0585b4cadf5beff05e68c05f2fa14fc750aedbc5745849fadd5bea9
SHA5124a68c1733be09e861f8098761a7f8be37b506389c39aeffa3c7cf152bfc45253a21413472dc8a398c7c89a757cabbcb8aaf205900a447769d3a0d92691983195
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
4KB
-
Filesize
4KB