Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 05:00
Static task
static1
Behavioral task
behavioral1
Sample
046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe
-
Size
170KB
-
MD5
046d3fdc0e51d8dd74905e8943524921
-
SHA1
7c77fa3e2ddd550084fe649603d59d316380e574
-
SHA256
827dd7af327d2e6287cc716697bd5a3600d02e7d0dcff0d2e3b6308046f12f28
-
SHA512
6c0ff415d3fb074a407dc0faed4162b3b8df4afe3c9bdb6213ca2ba363c5bedc4d305ec8e3107b2b7465c6c8aa48e5d130fea33835b585e2c80fa07529fd4193
-
SSDEEP
3072:+5ERKdsNSE8jWf+FnGevgjFA+WzmLpJhJ4RpS:+wB8qonGeoFA0lyp
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
lrunner.exepid process 2952 lrunner.exe -
Loads dropped DLL 1 IoCs
Processes:
046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exepid process 2316 046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
lrunner.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lrunner.exe -
Drops file in System32 directory 2 IoCs
Processes:
lrunner.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini lrunner.exe File opened for modification C:\Windows\System32\GroupPolicy lrunner.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
lrunner.exepid process 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe 2952 lrunner.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exedescription pid process target process PID 2316 wrote to memory of 2952 2316 046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe lrunner.exe PID 2316 wrote to memory of 2952 2316 046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe lrunner.exe PID 2316 wrote to memory of 2952 2316 046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe lrunner.exe PID 2316 wrote to memory of 2952 2316 046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe lrunner.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\046d3fdc0e51d8dd74905e8943524921_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ln259400022\lrunner.exe"C:\Users\Admin\AppData\Local\Temp\\ln259400022\lrunner.exe" --bpl="eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWUyMTk5ZTA2YWQ1Mzg1Zi0wLTAtIiwgInRzIjogMTU5NjY4OTYzOX0="2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Mail.Ru\IdFilesize
38B
MD5b2c55b61305dbfbb6a0786431fd44603
SHA1ae4475626ca1cf25e97c67550f5b481890bf903c
SHA2562e54f299015f7f0f4046bc0e19b09193db92cfe0b2fa33ee324178f69f8a9ce6
SHA5122f7176d6ea4ba3dd35558cac3ce0f27b610b2b6e898d0eba425c87670ad40fdf0581c6ea2deff00b59d385144be91666def6071bf19e3b5de6920c20d3dc60a5
-
\Users\Admin\AppData\Local\Temp\ln259400022\lrunner.exeFilesize
1.9MB
MD559ec4314e2a54053778d3862368d639c
SHA1a6e7e4383d2a49460f90f46d81bf31260fb71a50
SHA2568dca302c817de6eab1783ed87139cbe2c0da2be2ccc077cabac12ac3237dab91
SHA51248ec36e24c66df5951a35ff366aa80b70aef005119438e1a97dcc81b21e726a4f1eb7e9000026a75811e1fd7ef51255df28647b30140d136af223acf4e968834