Analysis

  • max time kernel
    141s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250610-en
  • resource tags

    arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/07/2025, 17:37

General

  • Target

    JaffaCakes118_1c71a0edb69e73f69f83dcd36adcfa08.exe

  • Size

    801KB

  • MD5

    1c71a0edb69e73f69f83dcd36adcfa08

  • SHA1

    f064dcec48a54131baef7223534dfe4a9b1eb9f8

  • SHA256

    2edb2dce6837129e1f164f61480a08cb829646f48a62888006fe9d80eb75da7e

  • SHA512

    2f9901d03d011c918e3f024786f377bffecd9d84d378e668d97d03ff2a07f9a29bec1e00f0e8887006cbb2b6c503f03587a8b825dc8b007cadcffa286edc0fe8

  • SSDEEP

    24576:FQWcDEciknpGtp8J8o5oRNINsuL0hFa0F2pHG:FQtQcXy/XhFa0F2pHG

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax family
  • Ardamax main executable 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c71a0edb69e73f69f83dcd36adcfa08.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c71a0edb69e73f69f83dcd36adcfa08.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5516
    • C:\Windows\SysWOW64\28463\HKDQ.exe
      "C:\Windows\system32\28463\HKDQ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5132
    • C:\Users\Admin\AppData\Local\Temp\MigPol.exe
      "C:\Users\Admin\AppData\Local\Temp\MigPol.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4808
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\28463\HKDQ.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5680
    • C:\Windows\SysWOW64\28463\HKDQ.exe
      C:\Windows\SysWOW64\28463\HKDQ.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1544

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\@4343.tmp

          Filesize

          4KB

          MD5

          d73d89b1ea433724795b3d2b524f596c

          SHA1

          213514f48ece9f074266b122ee2d06e842871c8c

          SHA256

          8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6

          SHA512

          8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41

        • C:\Users\Admin\AppData\Local\Temp\MigPol.exe

          Filesize

          48KB

          MD5

          6341b8be090c334814415ce8708a5388

          SHA1

          83abdb7364f17c5357fae33aa9ab31a200c67766

          SHA256

          80f437339788958d1b52858a6e05a8d4e7fafdfe26ea47482e1ea83fd33e85d6

          SHA512

          69c903fa5fb0de54464fec2a7539094b6758b9de1a54a4c2a9af0dea8b550808e036ec692b1ec12584a0e130133c4b82973862ca8f9711ce8aaec6487f33c112

        • C:\Windows\SysWOW64\28463\AKV.exe

          Filesize

          457KB

          MD5

          97eee85d1aebf93d5d9400cb4e9c771b

          SHA1

          26fa2bf5fce2d86b891ac0741a6999bff31397de

          SHA256

          30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24

          SHA512

          8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6

        • C:\Windows\SysWOW64\28463\HKDQ.001

          Filesize

          386B

          MD5

          1d30eab3bfc9b5615887e26e3517c245

          SHA1

          79853846a1e0cc2e45689047130e3a756fcde3ff

          SHA256

          e612023a86d87025e48488dd31c1610ff1299b99a41a61d846bdeb72e1eea09b

          SHA512

          e232852673492aa4b338f52ae2e0860e94f7c300d94aa2c54ee8fa4b1467ba8efc800294288c52d2ed5a52eb0aeeb08982c01299ed3eaa206420993a691c9806

        • C:\Windows\SysWOW64\28463\HKDQ.006

          Filesize

          8KB

          MD5

          35b24c473bdcdb4411e326c6c437e8ed

          SHA1

          ec1055365bc2a66e52de2d66d24d742863c1ce3d

          SHA256

          4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617

          SHA512

          32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de

        • C:\Windows\SysWOW64\28463\HKDQ.007

          Filesize

          5KB

          MD5

          a8e19de6669e831956049685225058a8

          SHA1

          6d2546d49d92b18591ad4fedbc92626686e7e979

          SHA256

          34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564

          SHA512

          5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8

        • C:\Windows\SysWOW64\28463\HKDQ.exe

          Filesize

          646KB

          MD5

          b863a9ac3bcdcde2fd7408944d5bf976

          SHA1

          4bd106cd9aefdf2b51f91079760855e04f73f3b0

          SHA256

          0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0

          SHA512

          4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a

        • C:\Windows\SysWOW64\28463\key.bin

          Filesize

          106B

          MD5

          639d75ab6799987dff4f0cf79fa70c76

          SHA1

          be2678476d07f78bb81e8813c9ee2bfff7cc7efb

          SHA256

          fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98

          SHA512

          4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2

        • memory/1544-70-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB

        • memory/1544-65-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB

        • memory/5132-33-0x00000000025F0000-0x00000000025F1000-memory.dmp

          Filesize

          4KB

        • memory/5132-55-0x0000000003430000-0x0000000003431000-memory.dmp

          Filesize

          4KB

        • memory/5132-39-0x0000000003420000-0x0000000003421000-memory.dmp

          Filesize

          4KB

        • memory/5132-38-0x0000000003420000-0x0000000003421000-memory.dmp

          Filesize

          4KB

        • memory/5132-37-0x0000000003420000-0x0000000003421000-memory.dmp

          Filesize

          4KB

        • memory/5132-36-0x0000000002590000-0x0000000002591000-memory.dmp

          Filesize

          4KB

        • memory/5132-35-0x00000000025D0000-0x00000000025D1000-memory.dmp

          Filesize

          4KB

        • memory/5132-34-0x0000000002610000-0x0000000002611000-memory.dmp

          Filesize

          4KB

        • memory/5132-41-0x0000000003420000-0x0000000003421000-memory.dmp

          Filesize

          4KB

        • memory/5132-32-0x0000000002600000-0x0000000002601000-memory.dmp

          Filesize

          4KB

        • memory/5132-49-0x0000000003460000-0x0000000003461000-memory.dmp

          Filesize

          4KB

        • memory/5132-48-0x0000000003410000-0x0000000003413000-memory.dmp

          Filesize

          12KB

        • memory/5132-47-0x0000000003410000-0x0000000003411000-memory.dmp

          Filesize

          4KB

        • memory/5132-54-0x0000000000D40000-0x0000000000D41000-memory.dmp

          Filesize

          4KB

        • memory/5132-56-0x0000000003470000-0x0000000003471000-memory.dmp

          Filesize

          4KB

        • memory/5132-40-0x0000000003420000-0x0000000003421000-memory.dmp

          Filesize

          4KB

        • memory/5132-52-0x0000000003420000-0x0000000003421000-memory.dmp

          Filesize

          4KB

        • memory/5132-53-0x0000000000D20000-0x0000000000D21000-memory.dmp

          Filesize

          4KB

        • memory/5132-42-0x0000000003420000-0x0000000003421000-memory.dmp

          Filesize

          4KB

        • memory/5132-43-0x0000000003420000-0x0000000003421000-memory.dmp

          Filesize

          4KB

        • memory/5132-44-0x0000000003410000-0x0000000003411000-memory.dmp

          Filesize

          4KB

        • memory/5132-31-0x00000000025B0000-0x00000000025B1000-memory.dmp

          Filesize

          4KB

        • memory/5132-20-0x0000000002400000-0x000000000245A000-memory.dmp

          Filesize

          360KB

        • memory/5132-18-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB

        • memory/5132-71-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB

        • memory/5132-72-0x0000000002400000-0x000000000245A000-memory.dmp

          Filesize

          360KB

        • memory/5132-73-0x0000000003410000-0x0000000003411000-memory.dmp

          Filesize

          4KB

        • memory/5132-74-0x0000000003460000-0x0000000003461000-memory.dmp

          Filesize

          4KB

        • memory/5132-78-0x0000000000400000-0x00000000004DF000-memory.dmp

          Filesize

          892KB