Analysis
- max time kernel
148s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 10:27
General
- Target 124f0b93c79dd5fba12c0b64eefd58aa_JaffaCakes118.exe
- Size 298KB
- Sample240504-mg764sbb6w
- SHA256 94c8217c6ca6741440e10e50742b44835eddba76885f5867ab776b3fe6e5f8d5
Malware Config
Extracted
-
formbook
-
3.9
-
be
-
linkedinideas.com
-
conceptcultivation.com
-
jerecyclemescapsules.com
-
waroenginggris.com
-
theparentslogue.com
-
yitongmoney.com
-
zonageneral.info
-
theeasyindia.com
-
scetup.net
-
alqcfka.com
-
canadensiscannabis.com
-
nouveaumonde-social.com
-
villerai.com
-
7665k.com
-
buzzfeedam2dm.net
-
8358358.com
-
tfuidw.men
-
brctsrm.com
-
kheyul.info
-
brotwirsthaus.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\124f0b93c79dd5fba12c0b64eefd58aa_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\124f0b93c79dd5fba12c0b64eefd58aa_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\AppData\Local\Temp\124f0b93c79dd5fba12c0b64eefd58aa_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
20Mlogim.jpeg
20Mlogrg.ini
20Mlogri.ini
20Mlogrv.ini
memory/1728-4-0x0000000075040000-0x00000000755F1000-memory.dmp
memory/1728-0-0x0000000075042000-0x0000000075043000-memory.dmp
memory/1728-2-0x0000000075040000-0x00000000755F1000-memory.dmp
memory/1728-1-0x0000000075040000-0x00000000755F1000-memory.dmp
memory/2716-7-0x0000000075040000-0x00000000750DB000-memory.dmp
memory/2716-6-0x0000000075040000-0x00000000750DB000-memory.dmp
memory/2716-10-0x0000000075040000-0x00000000750DB000-memory.dmp
memory/2716-5-0x0000000075040000-0x00000000750DB000-memory.dmp
memory/3140-14-0x0000000001180000-0x0000000001194000-memory.dmp
memory/3140-13-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3140-11-0x0000000001770000-0x0000000001ABA000-memory.dmp
memory/3140-8-0x0000000000400000-0x000000000042A000-memory.dmp
memory/3452-20-0x0000000007FD0000-0x0000000008145000-memory.dmp
memory/3452-23-0x00000000082A0000-0x000000000835E000-memory.dmp
memory/3452-15-0x0000000007FD0000-0x0000000008145000-memory.dmp
memory/5056-18-0x0000000000540000-0x000000000067A000-memory.dmp
memory/5056-16-0x0000000000540000-0x000000000067A000-memory.dmp