Analysis
- max time kernel
136s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/04/2024, 09:32
General
- Target 88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe
- Size 2.0MB
- Sample240402-lhxakach21
- SHA256 0136309b04a417b48dbd312209bda252b5a9abbe7e3b39a66f53d3ab72c2eb57
Malware Config
Extracted
-
formbook
-
4.1
-
cmsr
-
dahlia-dolls.com
-
iamawife.com
-
gardunomx.com
-
roweelitetrucking.com
-
asapvk.com
-
strategieslimited.com
-
healthyweathorganics.com
-
wedding-gallery.net
-
fastoffer.online
-
biolab33.cloud
-
los40delocta.com
-
charliepaton.com
-
jenpaddock.com
-
zzmweb.com
-
poetarts.com
-
techwork4u.com
-
tracylynpropp.com
-
rkbodyfit.site
-
migaleriapanama.com
-
cosmostco.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88fa2e2c92637d69a2733aa6764977c5_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1996-8-0x0000000005290000-0x00000000052A8000-memory.dmp
memory/1996-9-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/1996-2-0x0000000005140000-0x00000000051DC000-memory.dmp
memory/1996-3-0x00000000057E0000-0x0000000005D84000-memory.dmp
memory/1996-4-0x00000000052D0000-0x0000000005362000-memory.dmp
memory/1996-5-0x00000000054A0000-0x00000000054B0000-memory.dmp
memory/1996-0-0x00000000005F0000-0x0000000000802000-memory.dmp
memory/1996-6-0x0000000005270000-0x000000000527A000-memory.dmp
memory/1996-1-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/1996-7-0x00000000053D0000-0x0000000005426000-memory.dmp
memory/1996-10-0x00000000054A0000-0x00000000054B0000-memory.dmp
memory/1996-11-0x0000000005F90000-0x0000000005FE6000-memory.dmp
memory/1996-14-0x0000000074CB0000-0x0000000075460000-memory.dmp
memory/4384-12-0x0000000000400000-0x000000000042E000-memory.dmp
memory/4384-15-0x0000000001730000-0x0000000001A7A000-memory.dmp
memory/4384-16-0x0000000001730000-0x0000000001A7A000-memory.dmp