Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 00:56

General

  • Target

    8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe

  • Size

    1.8MB

  • MD5

    8e5aa61b53ae2546317d49fd13a1ca38

  • SHA1

    cd0feba3880c6a2ee2ca069662192e128bf42f86

  • SHA256

    e77fb691f75299fe6b0222573158be9791d9f43bfe027b68350d482eb48ec8c1

  • SHA512

    fcf8c487ddec1860ac939698dcc742720ca9a4ca22e4423b0a6c2ed370b0cdc6ec0cf1ae42a9f81158ed8d8c22317f4fe08ec078e5e8d8ab528a02c31872fbae

  • SSDEEP

    24576:acocf49vcQKqrsu22upB+RFUcmSuf4VSjRv1vxOWnUL9K5b1w2TLjTJe65h8ZDYN:acPSMCP84VSjVO5LMR1w2Tb5hYKF

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe"
    1⤵
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_34a2570" /pproc="explorer.exe"
      2⤵
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2732
      • C:\Users\Admin\AppData\LocalLow\cookieman.exe
        "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
        3⤵
        • Executes dropped EXE
        PID:2900

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\cookie.ini

          Filesize

          34B

          MD5

          3f4519b56cb1e006dfe4341e72112913

          SHA1

          0ff5675d359c898b6a6bdc1dff10f71097bc9927

          SHA256

          125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

          SHA512

          78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

        • C:\Users\Admin\AppData\LocalLow\cookieman.exe

          Filesize

          62KB

          MD5

          d08288fc3c69e61dc0a1ca4744c18750

          SHA1

          f3bc8fcd38ce1a300678de6421e11fc16799e754

          SHA256

          71a48a941d12f6e037f39365a4c1c575fe2ee8d3af3a070c3149cbb11338df0b

          SHA512

          a9c9a94c900803e8638d9e35606109592108f67b53d043e17a3d009cd5edcfb18c7f667ccbeedb45cff3cebb6c1d640b1a29d512113d75d2d4399204b4df4efc

        • C:\Users\Admin\AppData\Local\Temp\pkg_34a2570\autorun.txt

          Filesize

          89B

          MD5

          969dcc0aa8514c0efb1a0f121c90efd8

          SHA1

          a7cfc7d0bf24b7ccbc9eb184f07cf812e60b9ad8

          SHA256

          d5e69f09ef411af76e750bd29be7a31f635fcc514ccf9622f0a155edb33d47ba

          SHA512

          ea2e159d1e8d3b719ad0851b8ae26f8fb6c73860b105e171292c3ec4f4d464c808356799cfa007a53804876050e891b42f9c5520c99f668d1a83f1d4b6fcdfac

        • C:\Users\Admin\AppData\Local\Temp\pkg_34a2570\wrapper.xml

          Filesize

          692B

          MD5

          44601e00ff712607d2a0b64de786d843

          SHA1

          5696d1604b564a38669035faf395f78c933d8717

          SHA256

          424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

          SHA512

          7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1