Analysis
- max time kernel
141s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 10:19
General
- Target e9c5234672c791846a076210769b9c87_JaffaCakes118.exe
- Size 734KB
- Sample240409-mc1apsfh3t
- SHA256 95fa5bac570a78d55bc2494fbacdbf3d38402df53894c5c321db7f3d33639e1c
Malware Config
Extracted
-
formbook
-
4.1
-
bzbr
-
kingtton.com
-
j2task.com
-
richlitforkids.com
-
momentum-avocats.com
-
deddycamp.com
-
ovcelectrical.com
-
tbomed.com
-
riseofgenius.com
-
ctoimpact.com
-
wiki-u.com
-
konbitenterprise.com
-
yfhzpc.com
-
nilsoni.com
-
exoticgoldmines.com
-
cqmyn.com
-
deonbad.com
-
wheyproteines.com
-
nevadamidwives.info
-
hkxs99.com
-
goindiz.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9c5234672c791846a076210769b9c87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9c5234672c791846a076210769b9c87_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9c5234672c791846a076210769b9c87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9c5234672c791846a076210769b9c87_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4248 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1660-8-0x0000000005740000-0x0000000005796000-memory.dmp
memory/1660-9-0x00000000057F0000-0x0000000005808000-memory.dmp
memory/1660-2-0x0000000005820000-0x0000000005DC4000-memory.dmp
memory/1660-3-0x00000000050C0000-0x0000000005152000-memory.dmp
memory/1660-4-0x0000000005600000-0x0000000005696000-memory.dmp
memory/1660-5-0x00000000056A0000-0x000000000573C000-memory.dmp
memory/1660-6-0x0000000005260000-0x0000000005270000-memory.dmp
memory/1660-7-0x0000000002B60000-0x0000000002B6A000-memory.dmp
memory/1660-1-0x0000000000610000-0x00000000006CE000-memory.dmp
memory/1660-10-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/1660-0-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/1660-11-0x0000000005260000-0x0000000005270000-memory.dmp
memory/1660-12-0x00000000070B0000-0x000000000715C000-memory.dmp
memory/1660-13-0x0000000009260000-0x000000000929C000-memory.dmp
memory/1660-17-0x0000000074F00000-0x00000000756B0000-memory.dmp
memory/3452-16-0x00000000019C0000-0x0000000001D0A000-memory.dmp
memory/3452-14-0x0000000000400000-0x000000000042E000-memory.dmp