General
-
Target
JaffaCakes118_0e089d2651f67c2bc68323f244efaa10
-
Size
602KB
-
Sample
250605-eq3c8a1rt9
-
MD5
0e089d2651f67c2bc68323f244efaa10
-
SHA1
ba4ed19a8cbac62042c62c141cb95948558d4733
-
SHA256
aa4ceede8befb8dee83626234805595b81f582906f679724ec540cc51b0f8125
-
SHA512
91f68af7e86470190c5d757a1f7ff2a6325828a91d09eb2b356a622c41071911ee70bc7239a3a1fbdefafeab58bdde902c39cfdc7cdbbe3bfe4dab6134645df7
-
SSDEEP
12288:L3TdtLW5WIj1YSSdFxzBSXyMzBUWb9lx/9AgHLo8OW+rB0:LDsj1dEjBcJ9nPx/igrp+G
Behavioral task
behavioral1
Sample
JaffaCakes118_0e089d2651f67c2bc68323f244efaa10.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0e089d2651f67c2bc68323f244efaa10.exe
Resource
win11-20250502-en
Malware Config
Targets
-
-
Target
JaffaCakes118_0e089d2651f67c2bc68323f244efaa10
-
Size
602KB
-
MD5
0e089d2651f67c2bc68323f244efaa10
-
SHA1
ba4ed19a8cbac62042c62c141cb95948558d4733
-
SHA256
aa4ceede8befb8dee83626234805595b81f582906f679724ec540cc51b0f8125
-
SHA512
91f68af7e86470190c5d757a1f7ff2a6325828a91d09eb2b356a622c41071911ee70bc7239a3a1fbdefafeab58bdde902c39cfdc7cdbbe3bfe4dab6134645df7
-
SSDEEP
12288:L3TdtLW5WIj1YSSdFxzBSXyMzBUWb9lx/9AgHLo8OW+rB0:LDsj1dEjBcJ9nPx/igrp+G
-
Ardamax family
-
Ardamax main executable
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1