Analysis
-
max time kernel
132s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2024 01:36
Static task
static1
Behavioral task
behavioral1
Sample
1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe
-
Size
789KB
-
MD5
1a26f946ac1d1a308989f533596d5b5d
-
SHA1
a88e79bbdd4a3d47f47dd6c977bec9015e14c6b5
-
SHA256
e5d8344ae7d9f2641a4e564d0e6e1a6494e216e6a5be0355eb45190e25d11f8f
-
SHA512
ef7734f034793c582b30ed944c1ad91e42aef905bd84315f7ff44cc434cdb9635eb0e85d79e0f98181962faec55800b3c42a7881023f43a4f7323b4bd5746417
-
SSDEEP
12288:icFUncJ54irus265GoqlDX1YH0COI+w7Ror6PpGg+l2K3RYUOPlNTXm1XBv1HfeO:2nYnuRcBIoGblBhGlBKvdfF
Malware Config
Extracted
formbook
4.1
3nk4
teresaanaya.com
byronhobbs.com
altiizgara.com
reignsponsibly.com
kanistones.com
clickpk.site
aizzainvestments.com
bpqbq.com
openfitxbstretch.com
blackvoicesstore.com
yousefzaid.com
verdeaccounting.com
independentthoughtshow.com
fainlywatchdog.com
elreventondelsabor.com
spiceyourfood.com
1277hb.com
cesttoni.com
portalngs.com
turismoplayas.com
futurevisiondubai.com
grandpaeddiesbbq.com
tenkillersolutions.com
laagerlitigation.club
kyleandabbey.com
badassbae-bae.com
qraieahckby.com
moskvaoptom.net
autoserviceprovider.com
foodrhyme.com
andrew-vencetore.com
clasimovie.com
universitylook.com
123ufabet.club
bucearte.com
mytreasurecare.com
tenstarcleaning.com
iluvpictures.com
emvision.online
thepurplestrip.com
msrawyh.com
viiokey.com
davidgrayceramic.art
letsdiscover.coach
codingintamil.com
luxtourbus.com
appsofbuffalo.com
lunacardenas.com
aurifexinsurance.com
turkishhouse.restaurant
pureanddutch.com
thechurchboyapparel.com
eyebeamblue.com
upperbunk.com
jsruiyang.com
hillarykelly.com
stanleys.website
2r738euwdfhijn.com
luma-luxury-matchmaker.com
familycarehd.com
securitybyicon.com
myveeta-talents.com
nubianartstudio.com
liancaiwangv2.com
trulex.xyz
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4928-4-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exedescription pid process target process PID 4312 set thread context of 4928 4312 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exepid process 4312 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe 4312 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe 4928 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe 4928 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exepid process 4312 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exedescription pid process target process PID 4312 wrote to memory of 4928 4312 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe PID 4312 wrote to memory of 4928 4312 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe PID 4312 wrote to memory of 4928 4312 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe 1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928