bc43ee0eff59c762cf1b1c6cdabc578f83c36646ce4936797dcdb30b756975ba

General

Target

ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
Size

7.6MB
MD5

ebd655aa7f8b4d4efe09d73fff120bbd
SHA1

6d7576b7a8af97b04aea0d9f3a55da750dcca121
SHA256

bc43ee0eff59c762cf1b1c6cdabc578f83c36646ce4936797dcdb30b756975ba
SHA512

ff1f016a7e8592478ba7669758fa2d680b237a247d0295d6f5b3cdbd41bdb496ede0758d719c1e8bc60ebcd614612dbb7f69fc75e90eaa97b9fc0377ee76ae98
SSDEEP

196608:QlMlTiAuFyspTje2axQsUBUJ1hnYwMr+39RIFwacGKjv:QOTZ6VjaQbUHhTMrcJacGKT

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2896	servbrow.exe
4684	servbrow.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	servbrow.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\tj[1].js	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	servbrow.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\common[1].js	servbrow.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\hm[1].js	servbrow.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\242ZZAOF.htm	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	servbrow.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	servbrow.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\Ws2Help.dll	ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll	ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll	ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\Ws2Help.dll	ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Ws2Help.dll	ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\Ws2Help.dll	ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\servbrow.exe	ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	servbrow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	servbrow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	servbrow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	servbrow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	servbrow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	servbrow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	servbrow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	servbrow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	servbrow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	servbrow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	servbrow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	servbrow.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	servbrow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	servbrow.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	servbrow.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	servbrow.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTcbPrivilege	2896	servbrow.exe
Token: SeChangeNotifyPrivilege	2896	servbrow.exe
Token: SeIncreaseQuotaPrivilege	2896	servbrow.exe
Token: SeAssignPrimaryTokenPrivilege	2896	servbrow.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
2896	servbrow.exe
4684	servbrow.exe
4684	servbrow.exe
4684	servbrow.exe
4684	servbrow.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 4684	2896	servbrow.exe	110
PID 2896 wrote to memory of 4684	2896	servbrow.exe	110
PID 2896 wrote to memory of 4684	2896	servbrow.exe	110

C:\Users\Admin\AppData\Local\Temp\ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ebd655aa7f8b4d4efe09d73fff120bbd_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2728

C:\Windows\servbrow.exe
"C:\Windows\servbrow.exe" /Service
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\servbrow.exe
  "C:\Windows\servbrow.exe" /Popup
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3096 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\Ws2Help.dll

Filesize
7.6MB

MD5
10b450a9f70d523af4150cfe866d1105

SHA1
691948a12a4a1bcd791a46a3864de9b5f1fdc4dc

SHA256
d6949bf6c695a356ee2a1a3884b9a4570e978cbe5f9043565adc167fde559389

SHA512
ac906efb568e989d59504c19e54e66f7819f5d4fe370ad3dc12fb45d988ed403dd5ebcb4388712eb0f56e5a7754eeed725875b178222100834184ad97ce8482e

Download Submit
C:\Windows\servbrow.exe

Filesize
7.6MB

MD5
a5563adb74da047833454888acf2deac

SHA1
7bdc5ab78022018a87f6fe696f66339f6e582b4f

SHA256
2f8368b95a7d2a8be3fcd6195b9f8b78bcd0bc6aa1a7fa128014b7d9eab7574d

SHA512
74131d59999d84bc1ba2bb306b2c2fa85ea9ff94454b4c14d42df2034e5fc5f1e054c3c3ea2ab863b0183924432d40bdd1dba9b370b3df0b983d729ebf92399f

Download Submit

Analysis

Sharing