Overview
overview
7Static
static
3ab522187ac...18.exe
windows7-x64
7ab522187ac...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3JWEB.exe
windows7-x64
3JWEB.exe
windows10-2004-x64
5JWEB2.exe
windows7-x64
3JWEB2.exe
windows10-2004-x64
3MyABCD.exe
windows7-x64
3MyABCD.exe
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3lemon.swf
windows7-x64
3lemon.swf
windows10-2004-x64
3save.exe
windows7-x64
3save.exe
windows10-2004-x64
3Analysis
- max time kernel
119s - max time network
137s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
19/08/2024, 14:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ab522187ace21584bcffcd329eb7852b_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab522187ace21584bcffcd329eb7852b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
JWEB.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
JWEB.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
JWEB2.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
JWEB2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral9
Sample
MyABCD.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
MyABCD.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
Uninstall.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
lemon.swf
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral16
Sample
lemon.swf
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
save.exe
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
save.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target lemon.swf
- Size 12B
- Sample240819-reffjaybjf
- SHA256 7951ca54bd3da472fe0ba861ebdd900dc8d4458d5b3b5ee637f7ba40578eee7f
- MD5 b91576a4e8dcf032d6638ffb2bc2549a
- SHA1 7238c08079297c04526cc3b3f1407dba90bf2475
- SHA512 cb0b4c568345376b7cf85eabaf6946858bd4322f93e61bbea1d5f0ca033165a274938c474f925102453d65335c8c1c82ea5cf59f890c7c26ca9eb78551529311
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE - Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = f08a19f740f2da01 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430238247" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{349B3D11-5E34-11EF-B44F-526249468C57} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\swf_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\swf_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\swf_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\swf_auto_file\shell\open\CommandId = "IE.File" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\swf_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.swf rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.swf\ = "swf_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\swf_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\swf_auto_file\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\swf_auto_file\ rundll32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2640 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2640 iexplore.exe 2640 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2624 2808 cmd.exe 31 PID 2808 wrote to memory of 2624 2808 cmd.exe 31 PID 2808 wrote to memory of 2624 2808 cmd.exe 31 PID 2624 wrote to memory of 2640 2624 rundll32.exe 32 PID 2624 wrote to memory of 2640 2624 rundll32.exe 32 PID 2624 wrote to memory of 2640 2624 rundll32.exe 32 PID 2640 wrote to memory of 2616 2640 iexplore.exe 33 PID 2640 wrote to memory of 2616 2640 iexplore.exe 33 PID 2640 wrote to memory of 2616 2640 iexplore.exe 33 PID 2640 wrote to memory of 2616 2640 iexplore.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\lemon.swf1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lemon.swf2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\lemon.swf3⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 1396d9219b163cd39ddecb4623eb6feb312a8b23134078c3d3928a0eb665e8eb
- MD5 d17def1ca8d6ab3f3cd56834491ae0d9
- SHA1 33a73d57192962ef0195986f91ecaf26658cabfd
- SHA512 bd7c14284a1f061f05f0cb55776ce497807e3a593af98234c0d2560b65022aaa83439c5ecd0fbf3555f0fa5bb32198e636d56574192118aec6fc19df5ef519fe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b87db332fc890cc4338eaabdeab64b3cd3ff26983febefb6c8d7800f742bb9a4
- MD5 3302bdbb2eac9a57478bf416cc753b5e
- SHA1 155f220e42f5d99095686c7d8a48d45932594c80
- SHA512 bae0b713a11b253e3dad8862adebc1a5ae8a8756f3d55f7d0dde97411e2fcb8556dd588fa519d85567dd4c524288b67bdc196a278c4db26d6763449b185a5699
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 fc67a51fa3f06e73ec4ceb715f9f7891198fc650f1103c62271c6d9cabfaa8b1
- MD5 eb6ea4d4c3e2f4a7cd93a2198289447a
- SHA1 c225772f4c1692e3819dc578dc4422bf42a3022b
- SHA512 1e19af71ff35b2260c6b026583d3a67976402918d07f56b5c7c06b0fd8457b93413fdb57be493406fc14e2139a3acf3207f1aa9406209df938a13e990be2e427
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 71e44a1fdd5aa6931f10df7262abe13a4f5c5a7b009fca98b7f104276c9e6860
- MD5 01a0b4f64b0fa9eee5148e7eebd15043
- SHA1 b3da06379f9a4601946a95b919bd7b2575c9847e
- SHA512 223ec789752de4e6b7636bde911389b91192f1eeadaeeef706b48b32ab66af58797b910d38133696b5beebd0f706c998aac274f33ee2e0420f9e7eddd5602963
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 2279a62479cef2bad98ffa7295d6510e3576f67e3da0197ef2619ecee331198f
- MD5 55ba1c4d6462be8dba274f32c3066266
- SHA1 19f87ba8f607e677be28cae80de49a143c1f1e27
- SHA512 0a4f455407fbb7e64ec405af60287c91c2cd8e2e52b60e97e4bcc3e3fb6e88b0bb7e0ef0cda1d91977ec533ae55034a35310740a56932f52a3e5c11e94400206
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 29991faae438cb7d21c64b3eb12b6d2424afb48e6c1423772bc0b85353939a73
- MD5 5ea625385bbfdb311461ac0c0da8a459
- SHA1 eaf7889814ba115b7c7227b99d590a74570725b5
- SHA512 648085b76e668d40852d9d319c94bb3da02cbbc83f8c11a0eabf47c6fd7e6c0dd273354320c1c26b218c16213e032d507f74dcbca556256cafc1722b594ddcc1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 47089fbf56db1c7feb0acfd5a66ac252fa64f4301e9999d08b7fc8954f2678a7
- MD5 7600826fb09c652e2f8bbc9070a83d52
- SHA1 36835c0409e3055ed141cf208ee4beee5207dff3
- SHA512 b954737976499bec5a638b24b83fd2eb8fff065718cba31bf7509989e628d8d43dd455d54bcc23c66587d93b025c279dc54c51eb7206a18fce05a3b40941287c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 56c5d5f08bf099f5063310414588913bc77c52d2159d98fb30f78a0376bda3da
- MD5 512c8cba5a7dfaf7dc7f7507155cde49
- SHA1 4b1f0f94f8314384019988fa0894edbdbc6694ea
- SHA512 863a3822ae892e44170219bea753a5d12fcee4d336dd712f556fd61c5c5ee01bb54e9175585e0e115aa50aa99a9dfb5d8c5f851c3274c0074bf8ebf21fe33539
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab9CEB.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar9DCA.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP