Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    06-05-2024 17:34

General

  • Target

    1d9d946599bbe47314f6dfa89f1c6e77_JaffaCakes118.exe

  • Size

    681KB

  • MD5

    1d9d946599bbe47314f6dfa89f1c6e77

  • SHA1

    7bbdeb9670c8dc3a4f529b41b88cdd0900acad00

  • SHA256

    15af9bb36b7a51efea7ab70d98a29ef7059f4f5b7178fef0aaff0671bf6c9386

  • SHA512

    667d49dbd33d8e62da14ec03d1b138fee8df6ca580112e81437225bce9be3853d4485922f902206412342dede766140b44bfe718e6b567ff5ed75f6cd6e675cd

  • SSDEEP

    12288:SY2SRgOu9uO2dm4rqoXa3p1nirvopIBP8A1cNChQS0Vc:SxSJvObTV37irvopI1rVR

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nk4

Decoy

teresaanaya.com

byronhobbs.com

altiizgara.com

reignsponsibly.com

kanistones.com

clickpk.site

aizzainvestments.com

bpqbq.com

openfitxbstretch.com

blackvoicesstore.com

yousefzaid.com

verdeaccounting.com

independentthoughtshow.com

fainlywatchdog.com

elreventondelsabor.com

spiceyourfood.com

1277hb.com

cesttoni.com

portalngs.com

turismoplayas.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d9d946599bbe47314f6dfa89f1c6e77_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1d9d946599bbe47314f6dfa89f1c6e77_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Users\Admin\AppData\Local\Temp\1d9d946599bbe47314f6dfa89f1c6e77_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\1d9d946599bbe47314f6dfa89f1c6e77_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2448-4-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2448-6-0x0000000000430000-0x0000000000497000-memory.dmp

    Filesize

    412KB

  • memory/2448-8-0x0000000000770000-0x0000000000A73000-memory.dmp

    Filesize

    3.0MB

  • memory/2460-0-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2460-1-0x00000000005B0000-0x00000000005BF000-memory.dmp

    Filesize

    60KB

  • memory/2460-2-0x00000000005B0000-0x00000000005BF000-memory.dmp

    Filesize

    60KB

  • memory/2460-3-0x00000000008B0000-0x00000000008B1000-memory.dmp

    Filesize

    4KB

  • memory/2460-5-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB