524233df22b5be7d949d962ee13011113d24978ff6ca5ca6dcc05cfa2fa8f75c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
895b93515b3798e4567e50fda270ae04_JaffaCakes118.exe
Size 1.5MB
Sample240601-e14zssad58
SHA256 524233df22b5be7d949d962ee13011113d24978ff6ca5ca6dcc05cfa2fa8f75c
MD5 895b93515b3798e4567e50fda270ae04
SHA1 28b0472a6581c9a9a9c3ab0e9f58fa715fd8c88c
SHA512 b47ebcad9ac4b13935fb7b0d4bea0f88533e9dce74d3ea3e6acb8b97c312b18cbbc5be54fc3fdd85ef113ec4e71ca90c09f0e2dace5b63b05e5da7a4b27f20d7
SSDEEP 24576:c5f6MGJ5uwKRRDa9DJoYHztD91O5tUNOWS0WrDQUl/EZNCRKvvgU1BCTrrTTTNZy:mDO9DLfIDLZQu8ZNLYU1BUTTJ340IL
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2180	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	895b93515b3798e4567e50fda270ae04_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2980	895b93515b3798e4567e50fda270ae04_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2980	895b93515b3798e4567e50fda270ae04_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\895b93515b3798e4567e50fda270ae04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\895b93515b3798e4567e50fda270ae04_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
- C:\Users\Admin\AppData\LocalLow\cookieman.exe
  "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read 1-vinstaller.com
  2⤵
  - Executes dropped EXE
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookie.ini

Path C:\Users\Admin\AppData\LocalLow\cookie.ini
Size 34B
SHA256 125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
MD5 3f4519b56cb1e006dfe4341e72112913
SHA1 0ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA512 78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40
MD5 SHA1 SHA512

Submit Download

cookieman.exe

Path C:\Users\Admin\AppData\LocalLow\cookieman.exe
Size 62KB
SHA256 01b7f78fa31081cc2b75225cb5720fbae4d3a47a7d4d097673beadd9abf967fd
MD5 159fa93d571585d6f50206447e8bf7b7
SHA1 a21d571e777f5f70026180ea8f5169fe576af8c0
SHA512 7d625268e65ef91ffdedceca411dcff3df4b8bf738a9bbac019c34e3e734221f3a6444229f0a3afc6c682693ecef25b1795779187a01a3a7c96e446fc96d74c1
SSDEEP 768:kLOZvT9VLx1yeveXrW/A1h4YEWXNKuc/oo3sWjcdpMqanTRONoy:kLOtTzx1hrYEqc/omsWjcdpCcoy
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.xml

Path C:\Users\Admin\AppData\Local\Temp\qs_419191e30\config.xml
Size 76KB
SHA256 a36cc1a1319a0b44d969a449d3c4ce64e93653fa0d668e34e1dbc498e52cf7c1
MD5 a4314c3565d400d9a0798c655f910147
SHA1 3c677e37b2e9ec52fd8da3463cd2ddcf0f2e3670
SHA512 1896758418433806f2ca0c6bfd7cf35a7f20a9ec678c04107928d9b2858bf092f9213b234d8333d2c15da76cf3e4706ca52cdc01d12c2b0fd90e27b26ab3f998
SSDEEP 768:l6GqB6BQ5oZcZ75GO8WlEEQc4KlH/UDo0t2JseFtVUXIcKB9Xub8:1WQ/8
MD5 SHA1 SHA512 SSDEEP

Submit Download