Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 20:15

General

  • Target

    268afc68ac43d35ebd367d49433f0e37_JaffaCakes118.exe

  • Size

    616KB

  • MD5

    268afc68ac43d35ebd367d49433f0e37

  • SHA1

    fdb5f6dd1e6194e439ab2380ed2cb49c0184a34a

  • SHA256

    5eec2983e5ade0317c7380df23c6e70e4cdae38bfd39c27668b982b787b1c40c

  • SHA512

    6b732ed56e428500deb390b0f6317c70f925a24ec572b9b076f78080dfdb19789cc987356b569aae2d472780e604fd55d0efca071e26f0d3dfea0a5e2383b65f

  • SSDEEP

    6144:7mGJqJqBQv2LZA52ewOm/UroZnsEZ5wqvWcQCnB5aMkY+LqEemje3Gs73KeJK:7mOaGLtec/KoJL7xBBOimje2sDKeJK

Malware Config

Extracted

Family

pony

C2

http://tolain.ru/tola/gate.php

Attributes
  • payload_url

    http://myp0nysite.ru/shit.exe

Extracted

Family

formbook

Version

3.8

Campaign

to

Decoy

13s9.com

stayingcentred.com

cravastudios.com

yukilegal.com

895manbet.com

bf1tdesign.com

jakeandjackie.com

squisita.online

nuoya68888.com

bizkaibus.live

pupnpints.com

bigflew.online

researchinabox.com

tenerifediscounts.com

spookyshoppe.com

huipai-trade.com

beroar.com

readysetshot.com

veggie.fyi

findworkjobsonline.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Formbook payload 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3500
    • C:\Users\Admin\AppData\Local\Temp\268afc68ac43d35ebd367d49433f0e37_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\268afc68ac43d35ebd367d49433f0e37_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3532
      • C:\Users\Admin\AppData\Local\Temp\TOLAbin.exe
        "C:\Users\Admin\AppData\Local\Temp\TOLAbin.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3256
      • C:\Users\Admin\AppData\Local\Temp\268afc68ac43d35ebd367d49433f0e37_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\268afc68ac43d35ebd367d49433f0e37_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • Accesses Microsoft Outlook accounts
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_win_path
        PID:3800
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240605343.bat" "C:\Users\Admin\AppData\Local\Temp\268afc68ac43d35ebd367d49433f0e37_JaffaCakes118.exe" "
          4⤵
            PID:2720
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\SysWOW64\rundll32.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4720
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\TOLAbin.exe"
          3⤵
            PID:5744
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:5848

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\240605343.bat

          Filesize

          94B

          MD5

          3880eeb1c736d853eb13b44898b718ab

          SHA1

          4eec9d50360cd815211e3c4e6bdd08271b6ec8e6

          SHA256

          936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7

          SHA512

          3eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b

        • C:\Users\Admin\AppData\Local\Temp\DB1

          Filesize

          46KB

          MD5

          8f5942354d3809f865f9767eddf51314

          SHA1

          20be11c0d42fc0cef53931ea9152b55082d1a11e

          SHA256

          776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

          SHA512

          fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

        • C:\Users\Admin\AppData\Local\Temp\TOLAbin.exe

          Filesize

          167KB

          MD5

          3903702822dd3f972ad6f23c855ebaea

          SHA1

          677a7b1e5a5b71f6f492c57a21dd1149cff95302

          SHA256

          e6c547ff98f9f695304185cc6b39567ae0bc64c63be6a21d1c97dbb941b378c3

          SHA512

          2f5844301a43176f5607dbf9406b97c9ad2220631499b3644b95faa5a2d9b3dc3ab4d18bcbaf01c37aea9defc5e067a71d0bf11d865c121a6c955d0d1df740b0

        • C:\Users\Admin\AppData\Roaming\K0PPRPEE\K0Plogim.jpeg

          Filesize

          74KB

          MD5

          a54265dac9c2d2a994bbbec561f09dbb

          SHA1

          2b895be1d3af4c52bb9b22bcd8b3b662c7b8a783

          SHA256

          2b71f295f1792bc34d278e3de6c66a4673353cb7ef81fe16b5d640927618c85d

          SHA512

          7831ff9ffa79e1a3f2f994ca0c2a689654266c14f1fcc69c81ade341bd0931dbe39d633fa67c70afe059ff23c05ba076fb0f2e33bc4abdcca8447ca40da4fc19

        • C:\Users\Admin\AppData\Roaming\K0PPRPEE\K0Plogrg.ini

          Filesize

          38B

          MD5

          4aadf49fed30e4c9b3fe4a3dd6445ebe

          SHA1

          1e332822167c6f351b99615eada2c30a538ff037

          SHA256

          75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

          SHA512

          eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

        • C:\Users\Admin\AppData\Roaming\K0PPRPEE\K0Plogri.ini

          Filesize

          40B

          MD5

          d63a82e5d81e02e399090af26db0b9cb

          SHA1

          91d0014c8f54743bba141fd60c9d963f869d76c9

          SHA256

          eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

          SHA512

          38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

        • C:\Users\Admin\AppData\Roaming\K0PPRPEE\K0Plogrv.ini

          Filesize

          872B

          MD5

          bbc41c78bae6c71e63cb544a6a284d94

          SHA1

          33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

          SHA256

          ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

          SHA512

          0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

        • C:\Windows\win.ini

          Filesize

          120B

          MD5

          fe0c4d84684551dc6429860c8e769578

          SHA1

          f181d3731695af4873cb9ccd41098b0bd7e7a98d

          SHA256

          e5aeb321c075f20134653784a42065464384b29690205bb2333446ade115f690

          SHA512

          74781dbc7d17392e43679b3f138885fa38bd040d9abbe676994df785877011d7dc75a9066f00c06d5020cdae461b76fa562888484fc53ef79414c54e035971c2

        • memory/3256-19-0x0000000000EC0000-0x000000000120A000-memory.dmp

          Filesize

          3.3MB

        • memory/3256-21-0x0000000000E90000-0x0000000000EBA000-memory.dmp

          Filesize

          168KB

        • memory/3256-20-0x0000000000EAB000-0x0000000000EAC000-memory.dmp

          Filesize

          4KB

        • memory/3500-22-0x0000000002480000-0x0000000002541000-memory.dmp

          Filesize

          772KB

        • memory/3500-37-0x0000000003C20000-0x0000000003CDD000-memory.dmp

          Filesize

          756KB

        • memory/3500-35-0x0000000002480000-0x0000000002541000-memory.dmp

          Filesize

          772KB

        • memory/3532-5-0x0000000002C10000-0x0000000002D10000-memory.dmp

          Filesize

          1024KB

        • memory/3532-7-0x0000000077671000-0x0000000077791000-memory.dmp

          Filesize

          1.1MB

        • memory/3532-4-0x00000000005E0000-0x00000000006E0000-memory.dmp

          Filesize

          1024KB

        • memory/3800-17-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/3800-27-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/3800-18-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/3800-15-0x0000000000400000-0x0000000000419000-memory.dmp

          Filesize

          100KB

        • memory/4720-32-0x0000000000D70000-0x0000000000D84000-memory.dmp

          Filesize

          80KB

        • memory/4720-30-0x0000000000D70000-0x0000000000D84000-memory.dmp

          Filesize

          80KB