94cb5e84212a6353fd3386f2d83f5b864c64f4bd3207eff718a843d172011a1f

General

Target

0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
Size

1.6MB
MD5

0624c43699e11e05e7f784bebcf17768
SHA1

9058c4eaad185dd7b22a67198f51baa6b4f13cb0
SHA256

94cb5e84212a6353fd3386f2d83f5b864c64f4bd3207eff718a843d172011a1f
SHA512

4a40fa2bba990473d32abadcf88ed62f15790668d9b556e3a13994fd60a0194c762ea68c276a35f6923d72cd23e587fb0caddf62611b950edf09db2a1a57dce1
SSDEEP

49152:WQagM/VkLHwbwexxcTcoOfhc8AxOVnbw+ij/TtCUjnbIM:ZEVkLAxPo0c8hB9ijnjbJ

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2784	cookieman.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
2684	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
2684	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2684	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2684	2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2684	2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2684	2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2684	2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2684	2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2684	2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	30
PID 2508 wrote to memory of 2684	2508	0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0624c43699e11e05e7f784bebcf17768_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_e9141420"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
9f311aeaab73b9cb6b963c75c0c22664

SHA1
dc168ad12ff00cdd1cb813966ffe7f67baab95c5

SHA256
61ff1ebc652ce8ce60a1f1f979f3068b1455c60aad2ca4c5989f53df57dde4f5

SHA512
1b39755db1d83d9eb330e2db60f413c431c7183ad1e3a1f1d63a7c14f02f73296d1e2814cf9f171ec7543cb21d4949707401c218ee0f26ea4230e3ef892b669d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_e9141420\autorun.txt

Filesize
74B

MD5
d8d2e91332c7d80f74c2c88eab43d854

SHA1
c75964341fbf593637d3aef581810840d5286935

SHA256
573f9a8e2bde40245c58f722286ca0d60901ff8abf3471b981d6f513e987dad2

SHA512
e1a51f805cfab92790cd51057f553afa9aecbb329d5dba054e1b5d6b4e022ae7403e2e0ce0a82a7c8f4902417fa34020844a39a120696d1c2b6ce7a354fdb21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_e9141420\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit

Analysis

Sharing