e361d8c4969e59f50d44309c5ba532f169417488d0500d1e738fac47374daa0b

General

Target

8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
Size

1.5MB
MD5

8802ef204e3dbf608605ddf123f38313
SHA1

0326a63c3cc319cda4db601884df5af50cc1faf7
SHA256

e361d8c4969e59f50d44309c5ba532f169417488d0500d1e738fac47374daa0b
SHA512

4555de9b44090e6990fb0c7ef6649f48448b4e5df07807dfbc2393ae01f902e18557d9c8b8744401d72e229ef2944b9eb0f6f6c1772b141c5797b059b600b9d8
SSDEEP

24576:LGoseufagFnX8dfncq6cPwKPqnLolyMEIChp2GClQjX0bX7xNTlRFbJjnOAJI8y:uZfaeqn56wwQqLolrEIC3J4r7/Tb3jny

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2884	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
2708	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
2708	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2708	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2708	3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	29
PID 3020 wrote to memory of 2708	3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	29
PID 3020 wrote to memory of 2708	3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	29
PID 3020 wrote to memory of 2708	3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	29
PID 3020 wrote to memory of 2708	3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	29
PID 3020 wrote to memory of 2708	3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	29
PID 3020 wrote to memory of 2708	3020	8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8802ef204e3dbf608605ddf123f38313_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_1639329f0"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
ab5cb7f226388cf9e27218fccfcced0c

SHA1
2c1f6f71c6887220d718c539ed7b210bc93af2d5

SHA256
c5c48cc063094e3663f0f1931831ac79a6a9e465be10db72e0b7f8130ec45276

SHA512
d6e2318553fe7aca3c186d0446163278e0481a8d244e9b837cec7fd72f5561534ac5b1a513a72202b433959556d1aff78d416c6a20dc73552b36aae9fc9a60cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_1639329f0\autorun.txt

Filesize
89B

MD5
58a969b357590fd2971439d5ab343379

SHA1
1f46d9495212b01e5624dc7cbeb863620bfdb0d3

SHA256
a6dc39a8d53b41ac452447af08fcd59986ee143ea1ebd61c7bb1933803e51215

SHA512
a554f247fe1920fef1687956036981d377a86481801d9ffa2da1ff9241fcae10ffaf9ed26faf9834a769a0358f624c5d0ad2616806453fa61282469ef8d11399

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_1639329f0\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit

Analysis

Sharing