4f8406b6537da0531838feba6fc870a4b5de85cb133017b9e8ad26be98bab01f

General

Target

2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
Size

1.8MB
MD5

2c1c86b5e02b7a22da3c64f9186380bd
SHA1

244942aa2050debb87efda827ba72f4d30dd3096
SHA256

4f8406b6537da0531838feba6fc870a4b5de85cb133017b9e8ad26be98bab01f
SHA512

b82b48ae629506ad6473b5ad197340cb6465ca3f04cfe603686b7fa2a3f815b2bba8ea24d25ad40543fa57f06ff9a98a42f4043783d4c2c5d901534cce62a2d1
SSDEEP

24576:Wco0DI7+5N9rL46OuC4lNeQjfA86eVY9SxyU1reYJvBpR2qw4FoTnGvql/NWmrYA:WcngkS26eVY9SxYYjpER4FoTll/sSKI

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3304	cookieman.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookieman.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5076	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
5076	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
5076	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
5076	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
2152	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
2152	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
2152	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
2152	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2152	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2152	5076	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe	85
PID 5076 wrote to memory of 2152	5076	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe	85
PID 5076 wrote to memory of 2152	5076	2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2c1c86b5e02b7a22da3c64f9186380bd_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_102a272070" /pproc="explorer.exe"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
62KB

MD5
9d8672d490ba0b1a3989c670c1a0f74e

SHA1
2d47f441b860339c49987186687678807a0d948c

SHA256
7d9abd06cc93a3e3fd151a33b716646750b594e1ef66bdd914e058d6dc1fa95e

SHA512
a5c7a7179bb6612be8cd75cfade7ff2a40a4fec56e267ff11f79c6918bfdb663c87a5f2e86dbb93fd2ef3aee7425eafc9a2f8e2206f2255c6aa7c3d324c37374

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_102a272070\autorun.txt

Filesize
80B

MD5
de217e33e99be8debb5d93e5e7d02c53

SHA1
1fc51570f97cbd7bd70506f2ccdb9c02e86ab48c

SHA256
d7233247418ee102d57fae3394970fd3d1744e00283e2a977ff00548fb5196f2

SHA512
63b0da673913ec83a215a9cf54c7c1452614bfda4f32f2464c35a96a928523e077c5aa47b351c83b582b5d5ca8c0676ef648655fba9ee880b56650e2bd90fa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_102a272070\wrapper.xml

Filesize
855B

MD5
3b46a5c4923c1d438102fb9e965e5932

SHA1
569c8e8833ab1e32f73c346c13a4af7d75c53aef

SHA256
673460c2cea14a2c7da140d631e184a36c768be13412ed652063c969c95eb1e3

SHA512
9be1bae0c85d67b3ffcc3e5509ed5926513cfa146d84322e45b7f78787192653516080261fd34874967b25e6a3736ea04cb736ec0e269ce1d5fd3f6b6e8d6667

Download Submit

Analysis

Sharing