8904f88cf4b3b67d7827332c4508495920e9313561da7480a0b0b32e530c059f

Analysis

max time kernel
134s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2024, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68d148faccdf0e6f645770a14fed3451_JaffaCakes118.exe
Size 1.5MB
Sample241022-ely51awdla
SHA256 8904f88cf4b3b67d7827332c4508495920e9313561da7480a0b0b32e530c059f
MD5 68d148faccdf0e6f645770a14fed3451
SHA1 0f31c9a524f984d4e454119c94ba8430a4f9a9ca
SHA512 afaf120c60de3535e91e46420b8270034ea7558e86790f496dbe2e766ec0ae2299255b5094325f6d0ae08beb487e0c79c83cb959a074db69745caa64c2ee8d57
SSDEEP 24576:JLJZoU7YgH4A2UBmRtgB5LK5YZhO24A7Tw6rnhDAJZDt3MO1xVTehWTI1/cqGxEQ:bYTOYgekj7trhMJZX1x4WTU1+wq8IP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2084	cookieman.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	68d148faccdf0e6f645770a14fed3451_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68d148faccdf0e6f645770a14fed3451_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookieman.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
316	68d148faccdf0e6f645770a14fed3451_JaffaCakes118.exe
316	68d148faccdf0e6f645770a14fed3451_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	316	68d148faccdf0e6f645770a14fed3451_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\68d148faccdf0e6f645770a14fed3451_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68d148faccdf0e6f645770a14fed3451_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:316
- C:\Users\Admin\AppData\LocalLow\cookieman.exe
  "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read 1-vinstaller.com
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookie.ini

Path C:\Users\Admin\AppData\LocalLow\cookie.ini
Size 34B
SHA256 125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
MD5 3f4519b56cb1e006dfe4341e72112913
SHA1 0ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA512 78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40
MD5 SHA1 SHA512

Submit Download

cookieman.exe

Path C:\Users\Admin\AppData\LocalLow\cookieman.exe
Size 62KB
SHA256 c3b15b54284aef19012bb4de469204e4b5c750326c709cb626d83adc50a8a396
MD5 d499de9beec036ab21b7bc216bb856e1
SHA1 624df92f7f25d97014373cb7eb8ed946ab11a9a6
SHA512 da2f9e260eaf727c8ec4aee6de8e9f3361ff0b4f042093dfae90cc92f68020c921474f4666eba75c1cd36740308efbf96e96f8018c14ca4c7e91fde3e8717cd0
SSDEEP 768:cLOZvT9VLx1yeveXrW/A1h4YIWXNKuc/oo3sWjcdFMqanTRONoy:cLOtTzx1hrYIqc/omsWjcdFCcoy
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.xml

Path C:\Users\Admin\AppData\Local\Temp\qs_421b1d40\config.xml
Size 67KB
SHA256 87769e4f096110a8022f977b3c41aaa8cd8f3a873b182a5c670dc003b94ad6e7
MD5 89dfc1a7c28c61b92276bc649e613d3a
SHA1 193a3510529699ecce4472543d9e7695c835e241
SHA512 42caff2f3a9ea5360ba692a6eaf37364327a54267a55664887d19b42822527a594baeb8090a199146e1d53bc54e33c4a855fc2e4890f42f231b48116a7f25279
SSDEEP 768:OMCDyfwM4NYDXG8pe7ja+UPG3QB9XuyDJ:XLJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

postback.response.json

Path C:\Users\Admin\AppData\Local\Temp\qs_421b1d40\postback.response.json
Size 726B
SHA256 63c2c571dd9fab3ab970b168a2df92814b15bd7ab795c292b14f9460723f4765
MD5 f3d8232f8a1d0c7d5ee6ba18034e61bf
SHA1 1fd7c83e77b03f8815ec07e012e3419a0fcdb44a
SHA512 f92cad29b54558d75570fd02f5fd53261ff783dd613da2a45d815f7badf9c35aad233144720fdbd1afde3df8d9c9461bd43c5872f2d5ea345a2097b3ce0b1c18
MD5 SHA1 SHA512

Submit Download