Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 02:17

General

  • Target

    c8199355d0ca0fe289ea4d1ee018ff47_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    c8199355d0ca0fe289ea4d1ee018ff47

  • SHA1

    ac0428f426c0bda431bd80f6abab183ccd484d07

  • SHA256

    127262efb50609596b0597f1f357d75ff1dca0a0519fd8805d4fac1b288abae7

  • SHA512

    0f1f70ef0bbfa75b53a57549ef170d493b2706bbb8c41c2288fb831ace0dce902e6b9fa97834baf4b0adaa995df3767318055ad43b5bd366bbe257678f1da395

  • SSDEEP

    12288:jSMa7/gxmfOwwi0O2iNNHeIwbZhqQGo7w7xamI3XdqKbE0xsoI76JswNaSctMX:bA/08EO17eIKZh7UdvI3tBbG76J4M

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

k9d0

Decoy

flourishpodcast.xyz

xn--nga.group

music-tomato.com

motory.store

arrivehike.info

xn--diseowebseo-4db.com

centpourcentsons.com

qnnjja005.xyz

annielynnrose.com

darlaevans.com

door-maximum.com

chinataibaifen.com

stickerhicks.com

ta2gamesstudio.com

jendelanews.com

milestoneneuro.com

premierconciergehomes.com

exitcounter.com

jrsway.com

famurainmobiliaria.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Formbook payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Users\Admin\AppData\Local\Temp\c8199355d0ca0fe289ea4d1ee018ff47_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\c8199355d0ca0fe289ea4d1ee018ff47_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Desktop.exe,"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Desktop.exe,"
          4⤵
          • Modifies WinLogon for persistence
          PID:4412
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Desktop.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Desktop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
          "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4276
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:2976
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\SysWOW64\cscript.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4140
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
          3⤵
            PID:2996

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe

        Filesize

        42KB

        MD5

        9827ff3cdf4b83f9c86354606736ca9c

        SHA1

        e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723

        SHA256

        c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a

        SHA512

        8261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Desktop.exe

        Filesize

        1.0MB

        MD5

        c8199355d0ca0fe289ea4d1ee018ff47

        SHA1

        ac0428f426c0bda431bd80f6abab183ccd484d07

        SHA256

        127262efb50609596b0597f1f357d75ff1dca0a0519fd8805d4fac1b288abae7

        SHA512

        0f1f70ef0bbfa75b53a57549ef170d493b2706bbb8c41c2288fb831ace0dce902e6b9fa97834baf4b0adaa995df3767318055ad43b5bd366bbe257678f1da395

      • memory/636-6-0x0000000005620000-0x0000000005630000-memory.dmp

        Filesize

        64KB

      • memory/636-3-0x0000000005170000-0x0000000005202000-memory.dmp

        Filesize

        584KB

      • memory/636-4-0x0000000005210000-0x0000000005564000-memory.dmp

        Filesize

        3.3MB

      • memory/636-5-0x0000000005570000-0x000000000560C000-memory.dmp

        Filesize

        624KB

      • memory/636-0-0x0000000000650000-0x0000000000756000-memory.dmp

        Filesize

        1.0MB

      • memory/636-7-0x00000000056F0000-0x0000000005718000-memory.dmp

        Filesize

        160KB

      • memory/636-8-0x0000000006990000-0x00000000069F6000-memory.dmp

        Filesize

        408KB

      • memory/636-9-0x0000000006950000-0x0000000006972000-memory.dmp

        Filesize

        136KB

      • memory/636-10-0x0000000005620000-0x0000000005630000-memory.dmp

        Filesize

        64KB

      • memory/636-2-0x0000000005720000-0x0000000005CC4000-memory.dmp

        Filesize

        5.6MB

      • memory/636-25-0x0000000074F80000-0x0000000075730000-memory.dmp

        Filesize

        7.7MB

      • memory/636-1-0x0000000074F80000-0x0000000075730000-memory.dmp

        Filesize

        7.7MB

      • memory/2264-28-0x00000000097F0000-0x00000000097F6000-memory.dmp

        Filesize

        24KB

      • memory/2264-33-0x0000000074F80000-0x0000000075730000-memory.dmp

        Filesize

        7.7MB

      • memory/2264-26-0x00000000054D0000-0x00000000054E0000-memory.dmp

        Filesize

        64KB

      • memory/2264-27-0x00000000071D0000-0x00000000071E4000-memory.dmp

        Filesize

        80KB

      • memory/2264-24-0x0000000074F80000-0x0000000075730000-memory.dmp

        Filesize

        7.7MB

      • memory/3576-38-0x0000000008550000-0x000000000864F000-memory.dmp

        Filesize

        1020KB

      • memory/3576-47-0x0000000008550000-0x000000000864F000-memory.dmp

        Filesize

        1020KB

      • memory/3576-52-0x0000000009020000-0x0000000009145000-memory.dmp

        Filesize

        1.1MB

      • memory/3576-49-0x0000000009020000-0x0000000009145000-memory.dmp

        Filesize

        1.1MB

      • memory/3576-48-0x0000000009020000-0x0000000009145000-memory.dmp

        Filesize

        1.1MB

      • memory/4140-46-0x00000000030C0000-0x0000000003153000-memory.dmp

        Filesize

        588KB

      • memory/4140-40-0x0000000000E90000-0x0000000000EB7000-memory.dmp

        Filesize

        156KB

      • memory/4140-41-0x0000000001200000-0x000000000122F000-memory.dmp

        Filesize

        188KB

      • memory/4140-42-0x0000000003280000-0x00000000035CA000-memory.dmp

        Filesize

        3.3MB

      • memory/4140-44-0x0000000001200000-0x000000000122F000-memory.dmp

        Filesize

        188KB

      • memory/4140-39-0x0000000000E90000-0x0000000000EB7000-memory.dmp

        Filesize

        156KB

      • memory/4276-34-0x00000000016A0000-0x00000000019EA000-memory.dmp

        Filesize

        3.3MB

      • memory/4276-30-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/4276-36-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/4276-37-0x0000000001640000-0x0000000001654000-memory.dmp

        Filesize

        80KB