Analysis
- max time kernel
133s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
05/05/2024, 00:36
General
- Target 152f259addce46dc95df6c65923925ed_JaffaCakes118.exe
- Size 674KB
- Sample240505-ax2caabh85
- SHA256 6be3f722a9d961b2b5e056c222ea5abc6c2bbe7825e0dd0e7ec773916e6e5445
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
3.9
Campaign
-
a20
Decoy
-
constructionremedyinc.com
-
hamiltonnorman.com
-
theredevelopmentcompany.com
-
efecto.net
-
jandacaramel.com
-
onlineexitpoll.com
-
akshikatech.com
-
innover-cotedopale.com
-
viralthinking.info
-
collectionsandcurators.com
-
reviewyourwebpage.com
-
metaquantic.com
-
qxmjt.com
-
jan-galo.com
-
jeeeplee.com
-
aelrokoqujmri.com
-
2cdyc.com
-
vibrational-harmony.com
-
lamarnt.com
-
agritistic.online
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\152f259addce46dc95df6c65923925ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\152f259addce46dc95df6c65923925ed_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2644-0-0x0000000000AB0000-0x0000000000B5D000-memory.dmp
memory/2644-1-0x0000000000ABA000-0x0000000000B4E000-memory.dmp
memory/2644-2-0x0000000000AB0000-0x0000000000B5D000-memory.dmp
memory/2644-3-0x0000000000ABA000-0x0000000000B4E000-memory.dmp