Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
31/03/2024, 00:09
General
- Target 47f7e7a32e8ee493383a5381731a6923_JaffaCakes118.exe
- Size 618KB
- Sample240331-afvs6shh9t
- SHA256 4bd4b9f79c629ce5f602b3cc8bacefb6c3779498d66b946be9da734111659f23
Malware Config
Extracted
-
formbook
-
4.1
-
useb
-
houseofbooksae.net
-
ipjfeugo.xyz
-
sandiegowavefc.store
-
kamerynemehiel.com
-
herbalhealthalert.com
-
nfmedco.com
-
dorhop.com
-
bookingscenter.com
-
blaclyteproductions.com
-
novatel-network.com
-
locomotionprogramming.com
-
dotchocolatebars.com
-
rohanyat.online
-
a2detail.com
-
cotedazurpropertyforsale.com
-
space-vantage.space
-
averysanswers.com
-
lionheartimagery.com
-
nozincwadi.com
-
lovemyduck.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47f7e7a32e8ee493383a5381731a6923_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47f7e7a32e8ee493383a5381731a6923_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\47f7e7a32e8ee493383a5381731a6923_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47f7e7a32e8ee493383a5381731a6923_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1428-6-0x0000000004EE0000-0x0000000004EEA000-memory.dmp
memory/1428-13-0x0000000075040000-0x00000000757F0000-memory.dmp
memory/1428-2-0x0000000005400000-0x00000000059A4000-memory.dmp
memory/1428-3-0x0000000004EF0000-0x0000000004F82000-memory.dmp
memory/1428-4-0x0000000004E20000-0x0000000004E30000-memory.dmp
memory/1428-5-0x0000000004E80000-0x0000000004E8A000-memory.dmp
memory/1428-8-0x0000000004E20000-0x0000000004E30000-memory.dmp
memory/1428-1-0x0000000075040000-0x00000000757F0000-memory.dmp
memory/1428-0-0x0000000000410000-0x00000000004B0000-memory.dmp
memory/1428-9-0x0000000005C90000-0x0000000005D2C000-memory.dmp
memory/1428-10-0x0000000005F20000-0x0000000005F9E000-memory.dmp
memory/1428-7-0x0000000075040000-0x00000000757F0000-memory.dmp
memory/3776-11-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3776-14-0x0000000001920000-0x0000000001C6A000-memory.dmp