Analysis

  • max time kernel
    95s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 17:04

General

  • Target

    25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe

  • Size

    832KB

  • MD5

    25d706432a68e859f5077ddbc32ad080

  • SHA1

    590d9c3130d54d383adf6a8cd5a23cf37bfd30f1

  • SHA256

    0b99070aab5819f15a3f08f1c7840bd9c255883bc9b225cb4b4695593670d905

  • SHA512

    851a7cc56fb9d6dbe25519b69df6ebdfc748e954094f0bae54fdae37e2b43d887b117d9d50ee169ba2280a6f00d8bb597bae609dd57d5eedc8ced7db3f560f1d

  • SSDEEP

    12288:NglZopx11vLYE0hZ6Nwd6sOEI/xDId2ylzeDjR34XuTBVs9PhylvcIca:NVj1yF4i6sGpylSni+TBV0P8cIca

Malware Config

Extracted

Family

formbook

Version

4.0

Campaign

3iw

Decoy

cepbank-direkt.com

lieoga.com

officialbetterbeardclub.com

media0702.com

safariflorist.com

vipinternationalinc.com

bitechanalytics.com

employeewage.com

truckingtag.com

priyaladiestailor.com

highlanderpiping.com

enargiapetroleum.com

vermilionranch.com

focusopgeld.com

kalem-euy.net

disypen.com

fairpayva.com

davidguner.com

idreferensi.com

dytt889.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Local\Temp\25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1304-11-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/1304-14-0x00000000013E0000-0x000000000172A000-memory.dmp

    Filesize

    3.3MB

  • memory/4704-6-0x0000000007EF0000-0x0000000007F8C000-memory.dmp

    Filesize

    624KB

  • memory/4704-3-0x0000000005590000-0x0000000005622000-memory.dmp

    Filesize

    584KB

  • memory/4704-4-0x0000000005560000-0x000000000556A000-memory.dmp

    Filesize

    40KB

  • memory/4704-5-0x0000000075010000-0x00000000757C0000-memory.dmp

    Filesize

    7.7MB

  • memory/4704-0-0x000000007501E000-0x000000007501F000-memory.dmp

    Filesize

    4KB

  • memory/4704-7-0x0000000005970000-0x0000000005982000-memory.dmp

    Filesize

    72KB

  • memory/4704-8-0x0000000075010000-0x00000000757C0000-memory.dmp

    Filesize

    7.7MB

  • memory/4704-9-0x00000000080D0000-0x0000000008166000-memory.dmp

    Filesize

    600KB

  • memory/4704-10-0x000000000A900000-0x000000000A97E000-memory.dmp

    Filesize

    504KB

  • memory/4704-2-0x0000000005AA0000-0x0000000006044000-memory.dmp

    Filesize

    5.6MB

  • memory/4704-13-0x0000000075010000-0x00000000757C0000-memory.dmp

    Filesize

    7.7MB

  • memory/4704-1-0x0000000000C00000-0x0000000000CD6000-memory.dmp

    Filesize

    856KB