Analysis
- max time kernel
157s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
21/04/2024, 02:18
General
- Target fe33711a4b55ee419481ef8e2ae68d7c_JaffaCakes118.exe
- Size 857KB
- Sample240421-crd1xagg7t
- SHA256 41426800f6abacfe11baaa98f532e48b152971d90958016a943e8e0fb7967b9e
Malware Config
Extracted
-
formbook
-
4.1
-
i6sj
-
earn1kdaily.com
-
inspirestudiopro.com
-
dirtiblvk.com
-
humanbehaviourschool.com
-
tsftextiles.com
-
viveroeljardindelaabuela.com
-
surreykeys.com
-
sf790.com
-
evergreenmortuary-cemetary.com
-
pspbizhi.com
-
ironwoodpianostudios.com
-
outrageouslywise.com
-
blacklivesmatterisajoke.com
-
reignauto.com
-
azw3.net
-
nondapack.com
-
dressahaulicboutique.com
-
pierrockellelive.com
-
theleagueofgeeks.com
-
matthiaswalpen.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe33711a4b55ee419481ef8e2ae68d7c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe33711a4b55ee419481ef8e2ae68d7c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fe33711a4b55ee419481ef8e2ae68d7c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe33711a4b55ee419481ef8e2ae68d7c_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1284-12-0x0000000000400000-0x000000000042E000-memory.dmp
memory/1284-15-0x0000000001300000-0x000000000164A000-memory.dmp
memory/2184-6-0x0000000005700000-0x000000000570A000-memory.dmp
memory/2184-3-0x00000000052C0000-0x0000000005352000-memory.dmp
memory/2184-4-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/2184-5-0x0000000005260000-0x0000000005270000-memory.dmp
memory/2184-0-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/2184-7-0x0000000007E70000-0x0000000007F0C000-memory.dmp
memory/2184-8-0x0000000007E00000-0x0000000007E1A000-memory.dmp
memory/2184-9-0x0000000005260000-0x0000000005270000-memory.dmp
memory/2184-10-0x0000000001180000-0x0000000001226000-memory.dmp
memory/2184-11-0x0000000001220000-0x0000000001254000-memory.dmp
memory/2184-2-0x0000000005940000-0x0000000005EE4000-memory.dmp
memory/2184-14-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/2184-1-0x0000000000830000-0x000000000090C000-memory.dmp