6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a

General

Target
jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe
Size 50KB
Sample260924-hb8s8sty2k
SHA256 6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a
MD5 5a0e54ade9b9dc22937ede4cf0913234
SHA1 7892276bf43487fc52a4e554427fab96c79d5a40
SHA512 c2f9fc24643e109205fd5d8e21bafcd32184c16635e5bc4913d731149ee9c374e8bacd6b91a9012f484cbcf7b0af71523dece13882f5108eabc67fc8b9f8fdc4
SSDEEP 768:74OqjrEtNYS91Y+N+wt+Ro3g58lGnIAf7Q3sYnZB79pSzlhX22222c2F7XjpTX:sOqjrEN2+yvkAclZB7jSzzK1X
TLSH
T182336C01F6C28676E53066B8ED1790C4C7B2BDA118A6D34A76FD687C2D2F2805C4DBE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09e5a4ef74bdd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280110"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000008dcafaeb39b4bdb91ac9d1830f9b87ba40a7628b96922abfa30ac81b9102c639000000000e800000000200002000000066ebb97915eedeaa51aff79fb2004ae03fcc68d10c6c0861c152c707cfcde2bd200000002e5511ba34b1caae18c848ff30d943ac07fe4d5d2fba1e47c7c121e650af886f4000000077e776e499d6155e3d42b717f76e58e2bc13073a02ce38aa982a67523e9aea0c3d9f5efb6061ffe171ad7293abcb185e18e18d021557f4696e74ffbc65857daf	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3944426760"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000002432aa57b05d1f879cea987c9faf9c108f0dc192259becff3c057f9f68b94ffa000000000e8000000002000020000000cf4afdd486158438993332d623d8b69cacfed0c7f2912f3bd67bb57fdab64cfe20000000c5815745bd80be132f6281a3a9d33a0eebaa028bb9b81f55ffef08e90ded344240000000ecafa0d70a7acc2c4291bbbfa05626500b81f45ab29141fb171dcc174078c9eb3d4547aea5044938f2f4dd6bdf67d4c62ea78e20e7c06d5c660f21bc68619473	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{169504FE-B7E2-11F1-8007-56B788D469C5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0073534ef74bdd01	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings	jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
920	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
920	iexplore.exe
920	iexplore.exe
3644	IEXPLORE.EXE
3644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1828	4240	jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe	88
PID 920 wrote to memory of 3644	920	iexplore.exe	100

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A3686F.js"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1828

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:920 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A3686F.js

Path C:\Users\Admin\AppData\Local\Temp\A3686F.js
Size 4KB
SHA256 d3292f476c0f471b9c6f290daa7e2e6189df5c54cb7f23995ca89094643a3b95
MD5 a95d1e00bb6a9d2d2c7ab1726f5bff6b
SHA1 7100a94da83263ab7dc83c259422109e9814c631
SHA512 3e2969db41023acc11a72974fbb4bde3cdcb63e0421d84ca94a6644ca6d252e355574ad2053ee20c314c963b05467e8be56d23b604ddaef1ea655c9c2990b6a0
SSDEEP 96:0sMcb0WOqovTSjjCtrSAFctAg6z94o3DD3w+sXiHa+KewnlX7tXMUdfdG1aRQavD:0FWOqomjjCtNiqxz9n3DD3lsXi66wlX5
TLSH
T157A1532D5936208AF2ED4AA3A1BD765A49F9736353F71F0C1A0779C2C9B071ED00C86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4240-4-0x0000000000010000-0x0000000000022000-memory.dmp

Download

Analysis

Sharing