801181c4b83bae110650f8ebff90e02a207659623ec884c9057b571618c5181a

General

Target
6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
Size 1.8MB
Sample241022-flqpas1bjm
SHA256 801181c4b83bae110650f8ebff90e02a207659623ec884c9057b571618c5181a
MD5 6901a90704d24c86e6ce821c0caf3f7c
SHA1 43de6e052dd5c5e2e51df6834a957d71793ea541
SHA512 b92a59585bd5c2f80bb33979e12c1ea8b92fa8e1863a51c04a226c866f928adfbb572d66d2eaf6ed2003ae4e3884021a6244f5a602c48b4074db3028d2771c2a
SSDEEP 24576:gcocf49vcQKqrsu22upB+RFUcmSuf4VSjRv1vxOWnUL9K5b1w2TLjTJe65h8hDYM:gcPSMCP84VSjVO5LMR1w2Tb5hwKk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4512	cookieman.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookieman.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2216	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
2216	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
2216	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
2216	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
4256	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
4256	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
4256	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
4256	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4256	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 4256	2216	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe	84
PID 2216 wrote to memory of 4256	2216	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe	84
PID 2216 wrote to memory of 4256	2216	6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\6901a90704d24c86e6ce821c0caf3f7c_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_4393931b0" /pproc="explorer.exe"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookie.ini

Path C:\Users\Admin\AppData\LocalLow\cookie.ini
Size 34B
SHA256 125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
MD5 3f4519b56cb1e006dfe4341e72112913
SHA1 0ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA512 78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40
MD5 SHA1 SHA512

Submit Download

cookieman.exe

Path C:\Users\Admin\AppData\LocalLow\cookieman.exe
Size 62KB
SHA256 71a48a941d12f6e037f39365a4c1c575fe2ee8d3af3a070c3149cbb11338df0b
MD5 d08288fc3c69e61dc0a1ca4744c18750
SHA1 f3bc8fcd38ce1a300678de6421e11fc16799e754
SHA512 a9c9a94c900803e8638d9e35606109592108f67b53d043e17a3d009cd5edcfb18c7f667ccbeedb45cff3cebb6c1d640b1a29d512113d75d2d4399204b4df4efc
SSDEEP 768:5LOZvT9VLx1yeveXrW/A1h4YRWXNKuc/oo3sWjcdRMqanTRONoy:5LOtTzx1hrYRqc/omsWjcdRCcoy
MD5 SHA1 SHA512 SSDEEP

Submit Download

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_4393931b0\autorun.txt
Size 93B
SHA256 db24ef4872c5d4f29161f18af968bab259512d5aa77545d440997b46a6e8c097
MD5 4f40d39b0f480bd4be0c9bf015966cdd
SHA1 4f38d23be94be3fc72c5850b66e874c4ab697749
SHA512 184a9e1ec24452ee6aed7fff80a6af7b158d5f72f3e3f7119cba3bf9c7669bb6d5e011a040d24d82ff4cfb90facd7cd30105d576a6c55abb50a8c4ddd7e5ead6
MD5 SHA1 SHA512

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_4393931b0\wrapper.xml
Size 692B
SHA256 424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9
MD5 44601e00ff712607d2a0b64de786d843
SHA1 5696d1604b564a38669035faf395f78c933d8717
SHA512 7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads