Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 09:04
Static task
static1
Behavioral task
behavioral1
Sample
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
6b0516bc7fc043ab6ffeaebcff4a2a6e
-
SHA1
32ade35075cbab5dd4857ed5767fd650cc985161
-
SHA256
f6a75ea0e317fe5ae60f1d4462b743641a9f2c14c0b23c4cc5f1ff8f4bd7de15
-
SHA512
7f8c99532b10eea63c2176a1dc0e62d4beec806d858de8885df49fbc2731bc89ce8de9f0726c6ff3634fbb8ffba9380ed01d69725e76af276bd03af006be9ee6
-
SSDEEP
24576:rHtD9tzOxWq1AUTCJfTlOIwSL5/dltciVcbWsDHFed9by9nKPlXXcMnYOEyrEY7k:hzOVtIJOIFdltciO/Hy9fdXrYORD5VlM
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\28463\LQRX.exe family_ardamax -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
LQRX.exeThe Stumbler.exepid process 2660 LQRX.exe 3060 The Stumbler.exe -
Loads dropped DLL 7 IoCs
Processes:
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exeLQRX.exeThe Stumbler.exepid process 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 2660 LQRX.exe 3060 The Stumbler.exe 2660 LQRX.exe 2660 LQRX.exe 3060 The Stumbler.exe 3060 The Stumbler.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
LQRX.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LQRX Agent = "C:\\Windows\\SysWOW64\\28463\\LQRX.exe" LQRX.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exeLQRX.exedescription ioc process File created C:\Windows\SysWOW64\28463\LQRX.007 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\LQRX.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\AKV.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\28463 LQRX.exe File created C:\Windows\SysWOW64\28463\LQRX.001 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\LQRX.006 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exeLQRX.exeThe Stumbler.exe6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language The Stumbler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe -
Modifies registry class 15 IoCs
Processes:
The Stumbler.exe6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB01A1E3-A42B-11CF-8F20-00805F2CD064}\ProgID The Stumbler.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB01A1E3-A42B-11CF-8F20-00805F2CD064} The Stumbler.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB01A1E3-A42B-11CF-8F20-00805F2CD064}\ The Stumbler.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB01A1E3-A42B-11CF-8F20-00805F2CD064}\LocalServer32 The Stumbler.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\The Stumbler.ActiveScript Host\Clsid The Stumbler.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C182663D-5711-CDF8-4A0A-56374A0A5637}\ = "CLSID_ContactUserAccountChangeCallback" 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C182663D-5711-CDF8-4A0A-56374A0A5637}\InprocServer32\ThreadingModel = "Apartment" 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\The Stumbler.ActiveScript Host\ The Stumbler.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\The Stumbler.ActiveScript Host The Stumbler.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\The Stumbler.ActiveScript Host\Clsid\ = "{DB01A1E3-A42B-11CF-8F20-00805F2CD064}" The Stumbler.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB01A1E3-A42B-11CF-8F20-00805F2CD064}\ProgID\ = "The Stumbler.ActiveScript Host" The Stumbler.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C182663D-5711-CDF8-4A0A-56374A0A5637} 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C182663D-5711-CDF8-4A0A-56374A0A5637}\InprocServer32 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C182663D-5711-CDF8-4A0A-56374A0A5637}\InprocServer32\ = "%CommonProgramFiles%\\System\\wab32.dll" 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DB01A1E3-A42B-11CF-8F20-00805F2CD064}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\THESTU~1.EXE" The Stumbler.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exepid process 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exeLQRX.exedescription pid process Token: 33 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Token: 33 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe Token: 33 2660 LQRX.exe Token: SeIncBasePriorityPrivilege 2660 LQRX.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
The Stumbler.exepid process 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe -
Suspicious use of SendNotifyMessage 13 IoCs
Processes:
The Stumbler.exepid process 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe 3060 The Stumbler.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
LQRX.exepid process 2660 LQRX.exe 2660 LQRX.exe 2660 LQRX.exe 2660 LQRX.exe 2660 LQRX.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exedescription pid process target process PID 956 wrote to memory of 4820 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe PID 956 wrote to memory of 4820 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe PID 956 wrote to memory of 4820 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe PID 956 wrote to memory of 4820 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe PID 956 wrote to memory of 4820 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe PID 956 wrote to memory of 4820 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe PID 956 wrote to memory of 4820 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe PID 956 wrote to memory of 4820 956 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe PID 4820 wrote to memory of 2660 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe LQRX.exe PID 4820 wrote to memory of 2660 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe LQRX.exe PID 4820 wrote to memory of 2660 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe LQRX.exe PID 4820 wrote to memory of 3060 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe The Stumbler.exe PID 4820 wrote to memory of 3060 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe The Stumbler.exe PID 4820 wrote to memory of 3060 4820 6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe The Stumbler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b0516bc7fc043ab6ffeaebcff4a2a6e_JaffaCakes118.exe"2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\28463\LQRX.exe"C:\Windows\system32\28463\LQRX.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\The Stumbler.exe"C:\Users\Admin\AppData\Local\Temp\The Stumbler.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD525530555085337eb644b061f239aa9d4
SHA18d91e099aba5439d4bfa8bce464c94e3e1acf620
SHA2563fb6b438ad1530abdd068bffb303fb8a4de51430e0e18ddb6b1a0469ffab8325
SHA512b1f9de0c276533a5a7070aeb2b6415cc1c0bdd2baf5e0645c6ac5ba767cab0d76e5b4461800d89724992af2c863294ada3c1eb2e4516183fe2010c33d47d6a2a
-
Filesize
1.2MB
MD55f38826a4455b0526c233f09ddf128cf
SHA15159095b88b590e1c505606519df8310c8b5b553
SHA256cd1779489e6cf758e816c8a5366cc07bff2c9ec36ad7f87d0c56a8d0579b4dec
SHA512618311ee08b0b972f761dd98fbccccfab3d70322967c08dbff63868ae5564123153c6fa1447bfd5ad253dc6a09cf6297b10c21ede7eaa99a0705c8e9bb214d66
-
Filesize
395KB
MD5d63cc8679a63448db1c64252e14e4ab5
SHA110b3a9ac4bc16e8ac1cd05e50b4d540fa3ef223e
SHA25629b3646a556879a4a48e4f2f81e09179c34ac2051ed3e4f4c28e293092470d3d
SHA512cb1911e1a77fb9be560aa4fd8bbef65e181b6d4438d65657501dbcd8dbf488ba01738a7222f35f8d4317e8df8c6f307d9e3623d6e3e45753e138b80fb68ff768
-
Filesize
398B
MD5c3d2dcfda51d963544617122124e3060
SHA13234ebd05b0285088800b1ef86a0072fe9a88463
SHA2564e408a8345556ce999f977b12fd2df8e491ba106c8d597937b0d53ed61e01ead
SHA5122a8a50d2608d424df48cc537ac4a0c4a703bdb26bd4a7d4a03f9e93e23693b6c0886a64c1da533e4d2cb9e5ffc3336224bf75211a8986b2158455494687113c2
-
Filesize
8KB
MD581e20f4361cf8f5a57812871c24d945e
SHA15d7877d6959ab26599b05795a71633f00c37a3da
SHA256e6e8b4a29dccb3531f58c75b754caf7f26afe3e7043239305fd0ae7ab2f7571d
SHA51269b1d75ab7123054bf98cf3a0f2cc7a0749cda8d85ebdef85be7d89f1454154ce29070907b934727a6c5276ff430e94810b87a5634d25d8529df9ee36fd20818
-
Filesize
5KB
MD5e9fbdcc2f5fb657fa519b3f5c69fc52d
SHA1c49cca77b46a59d620711de7564d43e5dafcd2b5
SHA256cc440cfc4ce1a1ff503cc9e8937c59aae64bfce4daa3e7dc757220a25cadc2e4
SHA512913759967e16b99d8ea66433e5dc99d5ddbf737be6784306e67c2b23a525b7a578fcae1028221d3209abc452ff30508eb750c62113c3868a7af36b544e525fb1
-
Filesize
473KB
MD597d8ad45f48b4b28a93aab94699b7168
SHA18b69b7fd7c008b95d12386f6da415097e72151de
SHA256661df22a66b2062b233eb0bd9665de924cfe0ac9c6ba29e20ffef24f817f9331
SHA5123351eac970bab391de410fcf1937da75d2e4722b808f10332f487ddfe469544e32e7d4ed0e5bdc19bd5f472cffcc55ca1498c95945b4e9c4ceff6ff5cc521c8a