a06a52b5dc993e47660a6d54bd47dcc675d3ac41a5adc08cb9aa7d7f89c64cc5

General

Target

0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
Size

1.8MB
MD5

0b6e14793154d9fe0aea79cacdf8d5d6
SHA1

b53a717b2d5777dcb0cd47e45f01cb2cb08b6613
SHA256

a06a52b5dc993e47660a6d54bd47dcc675d3ac41a5adc08cb9aa7d7f89c64cc5
SHA512

17a7c6caf0074bae658ef745c37f3c44de7d5968cd75fcb46fcc4f1c499d763fadb1b8c6a06539f2c31469ffd55c6953cb3d5ec05813b62038a354a1f7b4aaa0
SSDEEP

24576:gcocf49vcQKqrsu22upB+RFUcmSuf4VSjRv1vxOWnUL9K5b1w2TLjTJe65h8ZDY9:gcPSMCP84VSjVO5LMR1w2Tb5h4KF

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3996	cookieman.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookieman.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
544	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
544	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
544	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
544	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
2872	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
2872	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
2872	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
2872	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2872	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2872	544	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe	82
PID 544 wrote to memory of 2872	544	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe	82
PID 544 wrote to memory of 2872	544	0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Temp\0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0b6e14793154d9fe0aea79cacdf8d5d6_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_f312c2a10" /pproc="explorer.exe"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
62KB

MD5
d08288fc3c69e61dc0a1ca4744c18750

SHA1
f3bc8fcd38ce1a300678de6421e11fc16799e754

SHA256
71a48a941d12f6e037f39365a4c1c575fe2ee8d3af3a070c3149cbb11338df0b

SHA512
a9c9a94c900803e8638d9e35606109592108f67b53d043e17a3d009cd5edcfb18c7f667ccbeedb45cff3cebb6c1d640b1a29d512113d75d2d4399204b4df4efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_f312c2a10\autorun.txt

Filesize
77B

MD5
dfb0e800d7a80ff2e8a6d2a727250a7b

SHA1
cf9eec4a6dde795d23b339b6af7d31232bab4264

SHA256
3c5a1b6996379513dfc41ee5efb8c35dd6835bfbcbe40be016e96b744e971f55

SHA512
54e5c5a3c25d8bc62d4ddb41b98c7dc20265fddb19884eecea7ebd25d67fc15541fef1ec6db0077b7b53674375b1fb2e58333cce93c87b15cbfb84d1803f29da

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_f312c2a10\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit

Analysis

Sharing