Overview
overview
7Static
static
3ab522187ac...18.exe
windows7-x64
7ab522187ac...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3JWEB.exe
windows7-x64
3JWEB.exe
windows10-2004-x64
5JWEB2.exe
windows7-x64
3JWEB2.exe
windows10-2004-x64
3MyABCD.exe
windows7-x64
3MyABCD.exe
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3lemon.swf
windows7-x64
3lemon.swf
windows10-2004-x64
3save.exe
windows7-x64
3save.exe
windows10-2004-x64
3Analysis
- max time kernel
135s - max time network
130s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system - submitted
19/08/2024, 14:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ab522187ace21584bcffcd329eb7852b_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab522187ace21584bcffcd329eb7852b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
JWEB.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
JWEB.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
JWEB2.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
JWEB2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral9
Sample
MyABCD.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
MyABCD.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
Uninstall.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
lemon.swf
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral16
Sample
lemon.swf
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
save.exe
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
save.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target JWEB2.exe
- Size 28KB
- Sample240819-reffjaybjf
- SHA256 16be3cc51fd7d6f9b7dfd52b69ff6727b68f81123bb5be8bb940863f880b0d69
- MD5 927a780c86272e577a0dea05cebcee10
- SHA1 2133691455ec6912011978e74835529bac8d25fa
- SHA512 47f40991b308c0fe1204d49e8fb41d62d8f0574f57431318f12bbb50b1a17b1653869eb7f0d3be7210a051d81937343fa1e42cb5ab84508778dd189f1b807012
- SSDEEP 768:0ImwkVD7qMbKVjc9YFAg/zLtnGzcKdtIaGH86S:07XqMbKS9GLz1G87RS
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWEB2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430238240" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{306914B1-5E34-11EF-93F3-6E739D7B0BBB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000009fbce3876cdade80b17f607f63b0777100c9945700365d52f4850f35a77b57c1000000000e80000000020000200000001adde840d995efce27bc4dccebd920d95056560d784e3675625480057c07ef9f200000009a6a416a76fb882f04e85a1b01af5d0df383faa7689b01bcce87da5ea431ffb24000000036c2a6a18d99494696a92fe6f5ccd5aaca5ba80ab8813ff47f6db164c462e440c548a24005f40d4bc47e80a89d5ae49573086dd86eeb7ddf252f0784847e4db5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0853c0c41f2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000087d71c32c336748b3992df517f16a9e19b7d26d5cfc811162ae039467e5b8d41000000000e8000000002000020000000f5a20d7a2b655c6577b4f6cba7ca0500cdc87fc8f2f1fd01a0e97cbd3482762b90000000a50f7ae5e7c82706d6f9ceb712086acda3cf1e80d32eecd370fc924ef6db4b2ddcc783c66c1254d64de690ff8c166e9e4de2f71d06991f2ee2240cc4d4ea65ae22aace6036b2c59bca2bd505f6d744aa27549336eeb2fc54c08b9fecd06546824f93497a931abe8bcb023dafcce089da88316e75b993f5de6654d64de99d6e9ebf790bb3a9390b275bfe619fc9b6603e4000000008a9ce07ecfa77475b9a0ee3f663344dcd4f9672451a4eb96af29da1d3e14528de5e594dd39f6d8e336f443668d9d9bda5b94a09c1abfdc07598b5353761caa8 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3044 iexplore.exe 3044 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2652 wrote to memory of 3044 2652 JWEB2.exe 31 PID 2652 wrote to memory of 3044 2652 JWEB2.exe 31 PID 2652 wrote to memory of 3044 2652 JWEB2.exe 31 PID 2652 wrote to memory of 3044 2652 JWEB2.exe 31 PID 3044 wrote to memory of 2888 3044 iexplore.exe 32 PID 3044 wrote to memory of 2888 3044 iexplore.exe 32 PID 3044 wrote to memory of 2888 3044 iexplore.exe 32 PID 3044 wrote to memory of 2888 3044 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JWEB2.exe"C:\Users\Admin\AppData\Local\Temp\JWEB2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.regnow.com/softsell/nph-softsell.cgi?item=1711-62⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 e8517488f110c37301736c3d15376d5fa88e509602cdeaf505e184cd1bbdaa68
- MD5 0a999aad0f0803d4806396ee4482e887
- SHA1 06246d53e57d6f741b8a51a05c6d8503bd549e71
- SHA512 21e59a424aa5f98cfbc3034c14b13b01c62e61d26c3553ef2b92ce6e44769c90b991e1a10616fc2823301032cf459f739ee8c4d4b68ddb111b19c69c565465fb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 874a8121327ce4c1423807165ac9f4055a405d1cdbb78221ead6cb3ebbb86375
- MD5 ccf422f94b1a105475044539b41e2044
- SHA1 30974d926b6730fdb51d2eaa3fbf459b8f510c10
- SHA512 756ec2e2929aec86e02cfbd648f880e1be826b244359444bb69786e0bbc76fed416c9719b099a863d8773d637441affb58aa36079fd39f3b93af019a420d2d2a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 b29b3b0c01bb1215e5bf03e9bd75d6ffda3a86100ccf393e7d144823d1e9966f
- MD5 27638e0418ed49072cc0b41534c185b7
- SHA1 c6e03d825da1771c3778fa00e0c8a934db44e3f0
- SHA512 c80cfb04909fe51c86ab631468b36cd5673cac717600faf5654aebd2cf2e600adc599542badac53e3f18dc1277ab860027c182d3e6c54f653953a24c068d8f73
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 7fbf483e3ae70da3269cb1fed098934e2daa55a24f3457b8d6b3663cef236e10
- MD5 55278a64b27f2a9cb19bb2c0505dc78b
- SHA1 daf5e95ef653f33c121afa122fb1bfa92f0e67f4
- SHA512 0696360ec2d26678eef25735f4c0f8f48ae4051f1026936ba69f413744e2bf1752f7a8bbf960d30bb96841715a83d3f12915c3d3f4974f89fd604020a601bcbc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 a1a8de579e44d258037fd7ff008367e525ac5e2bc25bfa2c77814c1b86e7f080
- MD5 e715b420f52d9b5401e071939d20fe0b
- SHA1 2f30cd78e5a0a194d18a7137efd4c43715d04477
- SHA512 0182661074b9063fa2a62b5bc4760fd4c5ea47f98dd9b123a67e1ef90d2bdee7e23dd2185094361423dccb48c5a4339929d96e7c0604cdf78be16d6395f15a2d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 5a5f77065044a0c9e7a633b63203220dc163a55515cee776817884d8a49cde7a
- MD5 08b05016694c543d020507ab94c21eda
- SHA1 08ef73363fb4fe28325f4d2d60d5d699260df86d
- SHA512 621c830a5eee2fc27466973d0cc8573badc1b42287a8f2fb604e0ae274d0b04172b88294884611a328f5051cd8f6e8f4d03c821172932959d31767e810cdeef0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 db9a5acb5d0f07cc5bdfa0b127bcd173982f98a530e977ebede3b236f44f8528
- MD5 c6dd5cb0f9254a40769675417455a30e
- SHA1 998dfe7c54d75b90f9fe5739f35ef5f3da0c4682
- SHA512 9849593d8d75daa68413e5ff3bfa0954d442cedbc63205342062e539eea9d3b5dd8296ac2ef635da0f52e8ef0cf639b2eeb7eff7c0f1e0ce8e9f64d044d8895a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 ab7d01fb489fbc444087702cf6fcfbdac649a75bf14dc7d587dbfc3086987084
- MD5 c9d82ad2a067bb4128c547811e18e835
- SHA1 188c78656f27eaf30e267a833f74a7064302e75a
- SHA512 252449e5f9d08388d7291574afbe366899f039cd2d672fbba7b1460d8cc8b45aed279b0463ecd9676ad5b394cff8d5d3ad5411236aa55635eab98c308430cdf1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab1900.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar1980.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP