Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 07:41

General

  • Target

    23dc2a640442410ae6c23a73c2e2ae52_JaffaCakes118.exe

  • Size

    448KB

  • MD5

    23dc2a640442410ae6c23a73c2e2ae52

  • SHA1

    9933e0318d92fd2759068df828158e59035310c6

  • SHA256

    bccde349905fcc2c6c393e3f8664d37e640fbd8ec43fbdf47ab899fe8b443344

  • SHA512

    feb7bc136c8d08ac370f51e55b63a0fb595f59521fea3fc00eb2e7742e8368b26ecf1363d8030e96552333f7252e5f0ce6e6fec7b88e1c99caa3c59776d92a46

  • SSDEEP

    6144:kKUuubOrWe8ohBkSxZKx95h2ktgZHcNOEcG5WpJvpc22:kUuGmohBdKz5h2kO8cVGMpJRM

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

ts

Decoy

tablenook.com

referenceyouraccount.com

google-adw.site

xiangyu0769.com

arvoliittaa-nouwakasaitama.com

www473234.com

oneudy.com

vleku.com

beyonnc.com

aguirre.solutions

51hdz.com

pipe.ventures

productandconcept.com

comprar-ahora.com

migraineproject.com

tinder-match.express

itacruisebig.live

cryptostrength.com

61999w.com

makits.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23dc2a640442410ae6c23a73c2e2ae52_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\23dc2a640442410ae6c23a73c2e2ae52_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4448
    • C:\Users\Admin\AppData\Local\Temp\23dc2a640442410ae6c23a73c2e2ae52_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\23dc2a640442410ae6c23a73c2e2ae52_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2452-6-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4448-5-0x0000000076EA1000-0x0000000076FC1000-memory.dmp

    Filesize

    1.1MB