Analysis
- max time kernel
139s - max time network
121s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
03/04/2024, 22:20
General
- Target a8354ac26895717ce391ecc8fc359e6a_JaffaCakes118.exe
- Size 369KB
- Sample240403-19g3aaee5v
- SHA256 24921a10a0d39086e4c656ee2ac556155fc036c72c78cf2021f88b31b94f4058
Malware Config
Extracted
-
formbook
-
4.1
-
gr1c
-
soakyourgrains.com
-
duwego.com
-
aenkdesign.com
-
bikabbziu.xyz
-
thesawyerlegacy.com
-
koreanmodelbj.xyz
-
exceed-standards.com
-
syirsve.com
-
sachisushimontreal.com
-
thegalwaykitchen.com
-
accarwash-hub.com
-
connectwithmentor.com
-
luftfundament.online
-
ibrahimkaracan.com
-
biggersinsurance.com
-
desellon.com
-
tvnewscloset.com
-
digital-dre.com
-
ingocg.com
-
fernanda-ortiz.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a8354ac26895717ce391ecc8fc359e6a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8354ac26895717ce391ecc8fc359e6a_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 2683⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1232-23-0x0000000003B00000-0x0000000003C00000-memory.dmp
memory/1232-37-0x0000000004740000-0x000000000482F000-memory.dmp
memory/1232-30-0x0000000004740000-0x000000000482F000-memory.dmp
memory/1232-27-0x0000000006D60000-0x0000000006ED9000-memory.dmp
memory/1232-25-0x0000000006D60000-0x0000000006ED9000-memory.dmp
memory/2728-7-0x00000000006F0000-0x0000000000730000-memory.dmp
memory/2728-6-0x00000000748D0000-0x0000000074E7B000-memory.dmp
memory/2728-2-0x00000000006F0000-0x0000000000730000-memory.dmp
memory/2728-8-0x00000000006F0000-0x0000000000730000-memory.dmp
memory/2728-9-0x00000000006F0000-0x0000000000730000-memory.dmp
memory/2728-10-0x00000000006F0000-0x0000000000730000-memory.dmp
memory/2728-11-0x0000000008180000-0x0000000008280000-memory.dmp
memory/2728-3-0x00000000006F0000-0x0000000000730000-memory.dmp
memory/2728-1-0x00000000748D0000-0x0000000074E7B000-memory.dmp
memory/2728-4-0x00000000006F0000-0x0000000000730000-memory.dmp
memory/2728-5-0x0000000008180000-0x0000000008280000-memory.dmp
memory/2728-19-0x00000000748D0000-0x0000000074E7B000-memory.dmp
memory/2728-0-0x00000000748D0000-0x0000000074E7B000-memory.dmp
memory/2956-31-0x0000000000130000-0x0000000000144000-memory.dmp
memory/2956-32-0x0000000000130000-0x0000000000144000-memory.dmp
memory/2956-34-0x0000000000130000-0x0000000000144000-memory.dmp
memory/3048-12-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3048-24-0x00000000001E0000-0x00000000001F4000-memory.dmp
memory/3048-28-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3048-22-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3048-29-0x0000000000220000-0x0000000000234000-memory.dmp
memory/3048-20-0x0000000000B60000-0x0000000000E63000-memory.dmp
memory/3048-18-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3048-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/3048-14-0x0000000000400000-0x000000000042F000-memory.dmp