Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
8e5aa61b53ae2546317d49fd13a1ca38
-
SHA1
cd0feba3880c6a2ee2ca069662192e128bf42f86
-
SHA256
e77fb691f75299fe6b0222573158be9791d9f43bfe027b68350d482eb48ec8c1
-
SHA512
fcf8c487ddec1860ac939698dcc742720ca9a4ca22e4423b0a6c2ed370b0cdc6ec0cf1ae42a9f81158ed8d8c22317f4fe08ec078e5e8d8ab528a02c31872fbae
-
SSDEEP
24576:acocf49vcQKqrsu22upB+RFUcmSuf4VSjRv1vxOWnUL9K5b1w2TLjTJe65h8ZDYN:acPSMCP84VSjVO5LMR1w2Tb5hYKF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2900 cookieman.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 2732 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 2732 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2732 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2732 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2732 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2732 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2732 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2732 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2732 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2732 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2732 2364 8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e5aa61b53ae2546317d49fd13a1ca38_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_34a2570" /pproc="explorer.exe"2⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Users\Admin\AppData\LocalLow\cookieman.exe"C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com3⤵
- Executes dropped EXE
PID:2900
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34B
MD53f4519b56cb1e006dfe4341e72112913
SHA10ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA256125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
SHA51278c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40
-
Filesize
62KB
MD5d08288fc3c69e61dc0a1ca4744c18750
SHA1f3bc8fcd38ce1a300678de6421e11fc16799e754
SHA25671a48a941d12f6e037f39365a4c1c575fe2ee8d3af3a070c3149cbb11338df0b
SHA512a9c9a94c900803e8638d9e35606109592108f67b53d043e17a3d009cd5edcfb18c7f667ccbeedb45cff3cebb6c1d640b1a29d512113d75d2d4399204b4df4efc
-
Filesize
89B
MD5969dcc0aa8514c0efb1a0f121c90efd8
SHA1a7cfc7d0bf24b7ccbc9eb184f07cf812e60b9ad8
SHA256d5e69f09ef411af76e750bd29be7a31f635fcc514ccf9622f0a155edb33d47ba
SHA512ea2e159d1e8d3b719ad0851b8ae26f8fb6c73860b105e171292c3ec4f4d464c808356799cfa007a53804876050e891b42f9c5520c99f668d1a83f1d4b6fcdfac
-
Filesize
692B
MD544601e00ff712607d2a0b64de786d843
SHA15696d1604b564a38669035faf395f78c933d8717
SHA256424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9
SHA5127328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1