056b11fa167ded89f02392040e524502db93023c29d2ac7f3af05b8932461797

General

Target

a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe
Size

1.5MB
MD5

a068fe7c3f6d8893b07cf0eda39f6fbf
SHA1

d2c62ea8aecf05d7d696d09d63597343836e7b6a
SHA256

056b11fa167ded89f02392040e524502db93023c29d2ac7f3af05b8932461797
SHA512

82188221ce9d1b8c7b47f1eb81257bcdbeea001f39dfa2eeb2373ad223e326d698d5bc5761539bba7702dafcaf5ebd1a5c56a020e5ea1a83ec293fa32c8e8d60
SSDEEP

24576:YIwDaQfH8NDqzkIfj8C0HpEYkemS8AfYwXiGmCuo8qncyq+VNTEJjjnOAJIKu:Y3fHw9Ibt0HGYNmS8AfYwXDzznc4TEjo

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2640	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe
2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe
2732	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe
2732	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2732	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2732	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2732	2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2732	2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2732	2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2732	2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2732	2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2732	2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe	31
PID 2668 wrote to memory of 2732	2668	a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a068fe7c3f6d8893b07cf0eda39f6fbf_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_172c391350"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
9fa07d85fde03805f6a5f49408a49c34

SHA1
ce194840db93f12321c1b1c21bd482ebb03d317d

SHA256
37016cbcebd5678c14f989cf51fc044b50ca90b411f25bc82fcdc0c09d870b1d

SHA512
20f24e843f2176c4ed91813bd0d963a7269be8315f72e4f0f01281945a72a96a22d31a9d6c7ef5436e82fe8b453dd3f5bfc1a000437ac5e8b86dbf81330f0977

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_172c391350\autorun.txt

Filesize
79B

MD5
e4322290ec1cbb6eeb64683d9979b66e

SHA1
9e1b4553504ee39b44dca7236d66fa252b32df99

SHA256
6170d8266fbe7871da8b7269589a150edce26814b4158e4cc7b7993b8dbbd893

SHA512
ea5d507f943cd6480f68582b548bfc8d93a38772a0a128f4b29cb68b0fb2623b8f76f50a26aba70a7ab180a880be8edeaf558442df77527b270e4c73e6dc8a74

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_172c391350\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit

Analysis

Sharing