General

  • Target

    15ce1dbd6c7017ac8795d155f7727629_JaffaCakes118

  • Size

    729KB

  • Sample

    240505-d6k87sdg2t

  • MD5

    15ce1dbd6c7017ac8795d155f7727629

  • SHA1

    53c03a69f40b471e40f6575527360c0ca35fb91e

  • SHA256

    aac2ba3da594ae887440b4ff5ca9cab5efc3411ce5d7c72f9a8f2c93b41f384e

  • SHA512

    3ccb78e6e66351d231fb9809a6f70f032bc0e14985399cedb1c0cced2076de21c9038fb8de0fd2da14a74b6d2cbd4c933910748491f5b99acfc20ed542f54320

  • SSDEEP

    12288:B5DbP62jaMuUym1WbEOefroS2/MbUr3oaPFRRJENTfiPYanp6EfN0YCotZT6iVZn:bS2jaoyETro6bUB2TfiPYaTfFFY2

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cx0

Decoy

avtnywveba.club

championmanifesto.com

fuehren.net

smallbusinesshelps.com

langshun168.com

maxonone.com

2commasummit.com

feat.gallery

rgsbc.com

gamefa88vn.pro

dandeliondesignart.com

mksso-real.com

shroomsconnect.com

boscoandthebees.com

payday-loans.space

maryaab-lpc.com

vaaccidentdoctorsnearme.info

ensley1961.com

viilaa.com

paraboliclight.com

Targets

    • Target

      15ce1dbd6c7017ac8795d155f7727629_JaffaCakes118

    • Size

      729KB

    • MD5

      15ce1dbd6c7017ac8795d155f7727629

    • SHA1

      53c03a69f40b471e40f6575527360c0ca35fb91e

    • SHA256

      aac2ba3da594ae887440b4ff5ca9cab5efc3411ce5d7c72f9a8f2c93b41f384e

    • SHA512

      3ccb78e6e66351d231fb9809a6f70f032bc0e14985399cedb1c0cced2076de21c9038fb8de0fd2da14a74b6d2cbd4c933910748491f5b99acfc20ed542f54320

    • SSDEEP

      12288:B5DbP62jaMuUym1WbEOefroS2/MbUr3oaPFRRJENTfiPYanp6EfN0YCotZT6iVZn:bS2jaoyETro6bUB2TfiPYaTfFFY2

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Modifies Windows Defender Real-time Protection settings

    • Formbook payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Windows security modification

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks