Analysis

  • max time kernel
    140s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2025, 17:37

General

  • Target

    JaffaCakes118_1c71a0edb69e73f69f83dcd36adcfa08.exe

  • Size

    801KB

  • MD5

    1c71a0edb69e73f69f83dcd36adcfa08

  • SHA1

    f064dcec48a54131baef7223534dfe4a9b1eb9f8

  • SHA256

    2edb2dce6837129e1f164f61480a08cb829646f48a62888006fe9d80eb75da7e

  • SHA512

    2f9901d03d011c918e3f024786f377bffecd9d84d378e668d97d03ff2a07f9a29bec1e00f0e8887006cbb2b6c503f03587a8b825dc8b007cadcffa286edc0fe8

  • SSDEEP

    24576:FQWcDEciknpGtp8J8o5oRNINsuL0hFa0F2pHG:FQtQcXy/XhFa0F2pHG

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c71a0edb69e73f69f83dcd36adcfa08.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c71a0edb69e73f69f83dcd36adcfa08.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Windows\SysWOW64\28463\HKDQ.exe
      "C:\Windows\system32\28463\HKDQ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5512
    • C:\Users\Admin\AppData\Local\Temp\MigPol.exe
      "C:\Users\Admin\AppData\Local\Temp\MigPol.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2000
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\28463\HKDQ.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Windows\SysWOW64\28463\HKDQ.exe
      C:\Windows\SysWOW64\28463\HKDQ.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\@7A7F.tmp

          Filesize

          4KB

          MD5

          d73d89b1ea433724795b3d2b524f596c

          SHA1

          213514f48ece9f074266b122ee2d06e842871c8c

          SHA256

          8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

          SHA512

          8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

        • C:\Users\Admin\AppData\Local\Temp\MigPol.exe

          Filesize

          48KB

          MD5

          6341b8be090c334814415ce8708a5388

          SHA1

          83abdb7364f17c5357fae33aa9ab31a200c67766

          SHA256

          80f437339788958d1b52858a6e05a8d4e7fafdfe26ea47482e1ea83fd33e85d6

          SHA512

          69c903fa5fb0de54464fec2a7539094b6758b9de1a54a4c2a9af0dea8b550808e036ec692b1ec12584a0e130133c4b82973862ca8f9711ce8aaec6487f33c112

        • C:\Windows\SysWOW64\28463\AKV.exe

          Filesize

          457KB

          MD5

          97eee85d1aebf93d5d9400cb4e9c771b

          SHA1

          26fa2bf5fce2d86b891ac0741a6999bff31397de

          SHA256

          30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

          SHA512

          8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

        • C:\Windows\SysWOW64\28463\HKDQ.001

          Filesize

          386B

          MD5

          1d30eab3bfc9b5615887e26e3517c245

          SHA1

          79853846a1e0cc2e45689047130e3a756fcde3ff

          SHA256

          e612023a86d87025e48488dd31c1610ff1299b99a41a61d846bdeb72e1eea09b

          SHA512

          e232852673492aa4b338f52ae2e0860e94f7c300d94aa2c54ee8fa4b1467ba8efc800294288c52d2ed5a52eb0aeeb08982c01299ed3eaa206420993a691c9806

        • C:\Windows\SysWOW64\28463\HKDQ.006

          Filesize

          8KB

          MD5

          35b24c473bdcdb4411e326c6c437e8ed

          SHA1

          ec1055365bc2a66e52de2d66d24d742863c1ce3d

          SHA256

          4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

          SHA512

          32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

        • C:\Windows\SysWOW64\28463\HKDQ.007

          Filesize

          5KB

          MD5

          a8e19de6669e831956049685225058a8

          SHA1

          6d2546d49d92b18591ad4fedbc92626686e7e979

          SHA256

          34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

          SHA512

          5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

        • C:\Windows\SysWOW64\28463\HKDQ.exe

          Filesize

          646KB

          MD5

          b863a9ac3bcdcde2fd7408944d5bf976

          SHA1

          4bd106cd9aefdf2b51f91079760855e04f73f3b0

          SHA256

          0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

          SHA512

          4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

        • C:\Windows\SysWOW64\28463\key.bin

          Filesize

          106B

          MD5

          639d75ab6799987dff4f0cf79fa70c76

          SHA1

          be2678476d07f78bb81e8813c9ee2bfff7cc7efb

          SHA256

          fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

          SHA512

          4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

        • memory/4120-63-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB

        • memory/5512-36-0x0000000002400000-0x0000000002401000-memory.dmp

          Filesize

          4KB

        • memory/5512-48-0x0000000000500000-0x0000000000501000-memory.dmp

          Filesize

          4KB

        • memory/5512-39-0x0000000003210000-0x0000000003211000-memory.dmp

          Filesize

          4KB

        • memory/5512-38-0x0000000002380000-0x0000000002381000-memory.dmp

          Filesize

          4KB

        • memory/5512-37-0x00000000023C0000-0x00000000023C1000-memory.dmp

          Filesize

          4KB

        • memory/5512-42-0x0000000003250000-0x0000000003251000-memory.dmp

          Filesize

          4KB

        • memory/5512-35-0x00000000023E0000-0x00000000023E1000-memory.dmp

          Filesize

          4KB

        • memory/5512-34-0x00000000023F0000-0x00000000023F1000-memory.dmp

          Filesize

          4KB

        • memory/5512-33-0x00000000023A0000-0x00000000023A1000-memory.dmp

          Filesize

          4KB

        • memory/5512-50-0x0000000003260000-0x0000000003261000-memory.dmp

          Filesize

          4KB

        • memory/5512-49-0x0000000003220000-0x0000000003221000-memory.dmp

          Filesize

          4KB

        • memory/5512-41-0x0000000003250000-0x0000000003251000-memory.dmp

          Filesize

          4KB

        • memory/5512-47-0x00000000004E0000-0x00000000004E1000-memory.dmp

          Filesize

          4KB

        • memory/5512-43-0x0000000003250000-0x0000000003251000-memory.dmp

          Filesize

          4KB

        • memory/5512-44-0x0000000003250000-0x0000000003251000-memory.dmp

          Filesize

          4KB

        • memory/5512-40-0x0000000003200000-0x0000000003203000-memory.dmp

          Filesize

          12KB

        • memory/5512-31-0x0000000002200000-0x000000000225A000-memory.dmp

          Filesize

          360KB

        • memory/5512-19-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB

        • memory/5512-64-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB

        • memory/5512-65-0x0000000002200000-0x000000000225A000-memory.dmp

          Filesize

          360KB

        • memory/5512-66-0x0000000003250000-0x0000000003251000-memory.dmp

          Filesize

          4KB

        • memory/5512-70-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB