Analysis
-
max time kernel
95s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 17:04
Static task
static1
Behavioral task
behavioral1
Sample
25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe
-
Size
832KB
-
MD5
25d706432a68e859f5077ddbc32ad080
-
SHA1
590d9c3130d54d383adf6a8cd5a23cf37bfd30f1
-
SHA256
0b99070aab5819f15a3f08f1c7840bd9c255883bc9b225cb4b4695593670d905
-
SHA512
851a7cc56fb9d6dbe25519b69df6ebdfc748e954094f0bae54fdae37e2b43d887b117d9d50ee169ba2280a6f00d8bb597bae609dd57d5eedc8ced7db3f560f1d
-
SSDEEP
12288:NglZopx11vLYE0hZ6Nwd6sOEI/xDId2ylzeDjR34XuTBVs9PhylvcIca:NVj1yF4i6sGpylSni+TBV0P8cIca
Malware Config
Extracted
formbook
4.0
3iw
cepbank-direkt.com
lieoga.com
officialbetterbeardclub.com
media0702.com
safariflorist.com
vipinternationalinc.com
bitechanalytics.com
employeewage.com
truckingtag.com
priyaladiestailor.com
highlanderpiping.com
enargiapetroleum.com
vermilionranch.com
focusopgeld.com
kalem-euy.net
disypen.com
fairpayva.com
davidguner.com
idreferensi.com
dytt889.com
schuada.com
minimalistvineyards.com
qduola.com
creditoefectivo.info
healthynaturalbirthcontrol.com
work-from-home-today.com
xn--p5t311d5zvmga.com
ex1x.com
onsitelogistics123.net
yilingshenghuo.net
cddlmixer.com
libero-networks.net
hillsidesunshine.com
whanaruabayholidaypark.com
pfog.ltd
thelifewaykefir.com
italotranslations.com
zhaojianhua.net
coralkw.com
e-learning-studios.com
technicalworld.online
raiseyourcross.com
fromwheretohere.com
ducati-world24.com
tag.loans
fast-bank.com
njssnt.com
crypto-exch.com
178416.com
glorybeegarden.com
whistleblowerchasealayne.com
hikmetamca.com
cjnexgift.com
simorghcard.com
thebestofsecrets.com
803manbetx.com
valodokan.com
sacpropertysale.com
paintwithdrink.com
ikidpass.com
setappointments.online
keymatic-eg.com
lookappdev.com
starbuckranchtx.com
regulars6.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1304-11-0x0000000000400000-0x000000000042D000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exedescription pid process target process PID 4704 set thread context of 1304 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exepid process 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 1304 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 1304 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exedescription pid process target process PID 4704 wrote to memory of 1304 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe PID 4704 wrote to memory of 1304 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe PID 4704 wrote to memory of 1304 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe PID 4704 wrote to memory of 1304 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe PID 4704 wrote to memory of 1304 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe PID 4704 wrote to memory of 1304 4704 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe 25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\25d706432a68e859f5077ddbc32ad080_JaffaCakes118.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304