5e98d066cbe672776fcb8301b6421fe524134389e8e507f739472fbb77f6fac9

General

Target

9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
Size

1.8MB
MD5

9f050d05bbc30204d9983fa4a0c3cbed
SHA1

dad7a606a4be604d0f40469dcb830f72f09987e2
SHA256

5e98d066cbe672776fcb8301b6421fe524134389e8e507f739472fbb77f6fac9
SHA512

97057ef4a659e3a1852c71f29ece123abe0a9757a164e14dab753ab2d4a1465189ead792e626b9f50b2cfe06a2dc7d7e165e743d6dceb72640e3528637043785
SSDEEP

24576:6zWJ69qM6xE3IFu8jUIlYWM5ptIT8hdiUrT8mEdzvw1coPF/BJhFvvtg+N/9ppAP:6iHycM1+7dzvw1coPFTvS+pHpA6TrpKN

Score

7^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

cookieman.exe

pid process

3972 cookieman.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
3972	cookieman.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.execookieman.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookieman.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

pid	process
2632	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
2632	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
2632	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
2632	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
788	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
788	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
788	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
788	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

description pid process

Token: SeIncreaseQuotaPrivilege 788 9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	788	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

description	pid	process	target process
PID 2632 wrote to memory of 788	2632	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
PID 2632 wrote to memory of 788	2632	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
PID 2632 wrote to memory of 788	2632	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe	9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9f050d05bbc30204d9983fa4a0c3cbed_JaffaCakes118.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_1142c2130" /pproc="explorer.exe"
  2⤵
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:788
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
62KB

MD5
0370e44bf2286f0c9bbe5f1ade423ad7

SHA1
7f9b209d9f0f101e63f7be9b439559632fc577af

SHA256
49d483da60d386b551b65a41a3be21ddb55e93242c2bbc08742348700f539498

SHA512
5e021a5fe06c855b4cc9676ace91bf232e710c9db77795fc5572d8cd749f33b3a25e1d3007087ae7a43d1972a48816bfdca9236e820e93bd5da6925455a2a821

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_1142c2130\autorun.txt

Filesize
79B

MD5
c0517ad2476b7266a4f7c217176c250a

SHA1
e793752ac3c0d147dc64950047a20992a16eed95

SHA256
5e4feaef0a1d0c0ab3a015370954bb6f9ef416c3fb52a9705a59c62d667c9a27

SHA512
b5af7a29b71bace5a491616be03ad8526af2027723f9415b5c5e04812a8650f5d59db3f2da8a2971ba6fe7c3b497e91ec231d7c1913b867448397e6de08e9ff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_1142c2130\wrapper.xml

Filesize
692B

MD5
44601e00ff712607d2a0b64de786d843

SHA1
5696d1604b564a38669035faf395f78c933d8717

SHA256
424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9

SHA512
7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads