8b9420e9fb88406282a1781d304ce01926391fa860ef9386ecd44de3bca8a991

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
919771294d655c8d2476b4093af41979_JaffaCakes118.exe
Size 170KB
Sample240603-ne3paadh63
SHA256 8b9420e9fb88406282a1781d304ce01926391fa860ef9386ecd44de3bca8a991
MD5 919771294d655c8d2476b4093af41979
SHA1 df9f892eee64b82d6f1d0c2b4d6ffc94313c73bf
SHA512 57cc783cf2efddda9860be1458d161727c26f023200769fc703dd83d5d2809599100e0cac415966f248e963788bfca7f6fce7f7c939400133ce0f4911053b019
SSDEEP 3072:+5ERKdsNSE8jWf+FnGevgjFA+WzmLpJhJ4RpS:+wB8qonGeoFA0lyp
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4592	lrunner.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lrunner.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	lrunner.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	lrunner.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe
4592	lrunner.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4592	2452	919771294d655c8d2476b4093af41979_JaffaCakes118.exe	93
PID 2452 wrote to memory of 4592	2452	919771294d655c8d2476b4093af41979_JaffaCakes118.exe	93
PID 2452 wrote to memory of 4592	2452	919771294d655c8d2476b4093af41979_JaffaCakes118.exe	93

C:\Users\Admin\AppData\Local\Temp\919771294d655c8d2476b4093af41979_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\919771294d655c8d2476b4093af41979_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\ln240600671\lrunner.exe
  "C:\Users\Admin\AppData\Local\Temp\\ln240600671\lrunner.exe" --bpl="eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfcGFydG5lciIsICJxdWVyeV9zdHJpbmciOiAiYW1pZ29faW5zdGFsbD0xIiwgInRzIjogMTU5NjY0MjU3NX0="
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\ProgramData\Mail.Ru\Id
Size 38B
SHA256 580d47c7ba0b28eead689a302d2845d8687f9a43e827ab368209db52c1cbb2d0
MD5 f29267582350c61c7c4095071275c603
SHA1 4c7f8ef5a8fb9489d6acfabebf4183025f7c6f63
SHA512 7a300bec0e22e747e874d3c0ad935f534a861324f235e4536d10b71124304b8ba8182b9e9955a68725daf4651ca501b978cd4e4a953c2bd4b86700205cd2c713
MD5 SHA1 SHA512

Submit Download

lrunner.exe

Path C:\Users\Admin\AppData\Local\Temp\ln240600671\lrunner.exe
Size 1.9MB
SHA256 8dca302c817de6eab1783ed87139cbe2c0da2be2ccc077cabac12ac3237dab91
MD5 59ec4314e2a54053778d3862368d639c
SHA1 a6e7e4383d2a49460f90f46d81bf31260fb71a50
SHA512 48ec36e24c66df5951a35ff366aa80b70aef005119438e1a97dcc81b21e726a4f1eb7e9000026a75811e1fd7ef51255df28647b30140d136af223acf4e968834
SSDEEP 49152:c3LvUeQjx23t6DNp5z09LTIuQVqm4hkPlQqKLczrngrXGCsc4MpEod7VWopEIx:KmCxLTIuQlGknzrngrzD
MD5 SHA1 SHA512 SSDEEP

Submit Download