Analysis
-
max time kernel
136s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 19:43
Static task
static1
Behavioral task
behavioral1
Sample
2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe
-
Size
599KB
-
MD5
2171d7a11c215bdd470fcd398c776b6d
-
SHA1
5e87f0159bd179e69d935f1fcbc29c17bb72cea7
-
SHA256
b8cc9e2b1509abfb88b4b570456839e5c00a7ffa52da7ef3333eef7d7b00922c
-
SHA512
ce7baa4240d9a4fd9b89019739d369276d4b5ada3bd831147fe20a95ae2263b71c5e824d54af0f17df5c44edb6501058e79490e52e3a759e1b3b8f42beb8fe8b
-
SSDEEP
12288:rosspP5Lzf8osspP5LzfdxrEjf3kEHjyaQ4:opP5LTLpP5LTDA1uaQ4
Malware Config
Extracted
formbook
3.8
h35
maraudersinc.com
liebianwangluo.com
visit-australia.info
machiyane-kasukabe.com
hafizclub.com
merkburn.net
favoritetraffic2updating.win
adrian-oeser.net
nkshopdomaincpplt234.info
imperiodofutebol.com
welometocaloundra.com
thehealthypose.com
squalloptna.com
bobknowsbest.com
damgproperties.com
wastemastershire.co.uk
swacballet.com
japanbreakingnews.com
bjufaa.info
aryakuza.com
ericbellband.com
undecrypt.com
printrade.win
stfuxxxx.com
xn--m7rv64cc7d7q1an8c.com
aeints.net
agrotecsol.com
rntme.com
dqdrpmm.com
inseedbrand.com
0x1tenmoney.men
khudothidongvan2.com
newcasinouk.com
avocatdedieu.com
cagewo.com
tmay.ltd
35s4.review
blipeducated.com
businesscoveragetop.online
syxjsn.com
commspacein.com
johns.zone
cj336.com
mario-vestec.com
saviorpalliative.info
motherloderiches.com
socialworld.site
yongshiquan.com
listingbussiness.com
irritablebowelsyndromeip.com
brazoriacountynavy.info
greencoffeebeans.store
kk6z.com
blacktaxi.online
homeremedyforum.com
khujn.com
pipeai.com
www502789.com
bbz168.com
copydinner.win
wwwdld005.com
forumin3d.net
bacarragroup.com
sarandipiagaldar.com
dotcex.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4564-9-0x00000000005C0000-0x00000000005EA000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exedescription pid process target process PID 3500 set thread context of 4564 3500 2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1128 4564 WerFault.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3500 2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exedescription pid process target process PID 3500 wrote to memory of 4564 3500 2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe RegAsm.exe PID 3500 wrote to memory of 4564 3500 2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe RegAsm.exe PID 3500 wrote to memory of 4564 3500 2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe RegAsm.exe PID 3500 wrote to memory of 4564 3500 2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe RegAsm.exe PID 3500 wrote to memory of 4564 3500 2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe RegAsm.exe PID 3500 wrote to memory of 4564 3500 2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2171d7a11c215bdd470fcd398c776b6d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 5403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4564 -ip 45641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3500-0-0x00000000746CE000-0x00000000746CF000-memory.dmpFilesize
4KB
-
memory/3500-1-0x0000000000CD0000-0x0000000000D6C000-memory.dmpFilesize
624KB
-
memory/3500-2-0x00000000056B0000-0x00000000056D0000-memory.dmpFilesize
128KB
-
memory/3500-3-0x0000000003000000-0x0000000003006000-memory.dmpFilesize
24KB
-
memory/3500-4-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/3500-5-0x0000000008150000-0x00000000086F4000-memory.dmpFilesize
5.6MB
-
memory/3500-6-0x0000000007CA0000-0x0000000007D32000-memory.dmpFilesize
584KB
-
memory/3500-7-0x0000000008080000-0x000000000811C000-memory.dmpFilesize
624KB
-
memory/3500-12-0x00000000746C0000-0x0000000074E70000-memory.dmpFilesize
7.7MB
-
memory/4564-8-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4564-9-0x00000000005C0000-0x00000000005EA000-memory.dmpFilesize
168KB