Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-04-2024 12:01

General

  • Target

    8c07acde5c34ee8f47efd7050ede7bd4_JaffaCakes118.exe

  • Size

    619KB

  • MD5

    8c07acde5c34ee8f47efd7050ede7bd4

  • SHA1

    f4e7cd7933f4468fa7d5752463aa198842ad7b2e

  • SHA256

    da2458789c338c2719661254515dba2fc92c21ef91a11da3d192a6542ca56814

  • SHA512

    4cbb4a91e1ce60cb8d2b7d30307fdcb3c490770b994c9dc34688ada66d7c63fb0edc08cda407fcde2608d3eacdd2b4666702a0b15a008fa144ccd5d2eb26fe78

  • SSDEEP

    12288:sxTPnHq1OCpziAVfKrMY+V4xxqjC+thFuNppvppMkkkkkkkkkkkkkkkkkkkkkkkm:stPH0JpOmfKrMfVJCgVn

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cnp0

Decoy

jiarenyuanhunlian.com

xquizitelashesnwaxx.com

rentinerie.com

herbalpedia-id.com

openseagames.com

re-swap.com

william-cook.com

segensv.com

versebay.com

brendanlairdsound.com

bypestor.com

hospitaldelpc.net

wwwroadrunnerfinancial.com

waterhammerstudios.com

hustleandbank.photography

secure01bchslogin.com

rarepeperanking.com

greatland.company

happybirthdayjewel.com

raheok.store

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c07acde5c34ee8f47efd7050ede7bd4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8c07acde5c34ee8f47efd7050ede7bd4_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\8c07acde5c34ee8f47efd7050ede7bd4_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8c07acde5c34ee8f47efd7050ede7bd4_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2304-9-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2304-15-0x0000000000A40000-0x0000000000D43000-memory.dmp

    Filesize

    3.0MB

  • memory/2304-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2304-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2304-10-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2688-3-0x0000000004D50000-0x0000000004D90000-memory.dmp

    Filesize

    256KB

  • memory/2688-6-0x0000000004D50000-0x0000000004D90000-memory.dmp

    Filesize

    256KB

  • memory/2688-7-0x0000000004D50000-0x0000000004D90000-memory.dmp

    Filesize

    256KB

  • memory/2688-8-0x0000000005060000-0x00000000050B8000-memory.dmp

    Filesize

    352KB

  • memory/2688-5-0x0000000074DB0000-0x000000007549E000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-4-0x0000000000820000-0x000000000082E000-memory.dmp

    Filesize

    56KB

  • memory/2688-0-0x0000000001080000-0x0000000001120000-memory.dmp

    Filesize

    640KB

  • memory/2688-2-0x0000000004D50000-0x0000000004D90000-memory.dmp

    Filesize

    256KB

  • memory/2688-14-0x0000000074DB0000-0x000000007549E000-memory.dmp

    Filesize

    6.9MB

  • memory/2688-1-0x0000000074DB0000-0x000000007549E000-memory.dmp

    Filesize

    6.9MB