Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 06:19
Static task
static1
Behavioral task
behavioral1
Sample
28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe
-
Size
480KB
-
MD5
28adf2e4dcd354d59a63e52a362750a3
-
SHA1
79c5d1240daa8250b38433c5c6c06360ed2d1d02
-
SHA256
532b875f09991cdf7b57db59f0f7aa579d49b229d65ad1ace9f67bf6ffc7bca5
-
SHA512
d48f37f38642fc3998aa0cc8100144ead93d81ff2fddee7816e0248c54976141871ac1e7cf415912d0f2ce1f40a5e9008dbf0576cd1c1b207706fe760a857f6d
-
SSDEEP
12288:CD1QXaV8sNRth4NevW9DrKhhiV59W5DBJLx9NU3uV:AlLXdPhQVe
Malware Config
Extracted
formbook
4.1
cbsxx
i3w46yd-e8p36.com
vikingworrier.com
ytsunyea.com
staceyandkevin.com
vanwheel.com
insurancenashvillegeorgia.com
ikumou-pro.com
motivacaodigital.com
beypk.com
tekyildizgroup.com
nguyentruongphi.com
impalagoldcollective.com
uknus.net
xn--cjrz24b9ma835a.com
militaryeducations.com
hcszyz.com
frymanswelding.com
064415.com
lianyunbi.com
fishofthenet.com
laurymua.com
alphaprestigecars.com
magnumonlinetraining.com
credittrustb.com
0468.ink
updatemymovies.com
leemengistu.com
timn4-r.net
streetdreamsmd.com
julianaemaxwell.com
ngment.com
matzls.info
30-under-30.com
homesteadwebsites.info
kunnuoshiye.com
northcapital-holding.com
nnfzgs.com
guantianwa.com
qavxlk.info
atimetosearch.com
ramseyinfinity.com
pettainer.com
superiorwindowsolution.com
nevadapoker.info
torneoapple.com
qt-germany.info
rediscoveringrealestate.com
markfrancesco.com
puuqempp.com
sarahbreitenbach.com
getcoolfind.com
realslr.com
bombshellbeautyservices.com
episerv.com
458fxr.info
inspiral-architect.com
travel315.com
thisismysol.com
garekgodrik.com
artsook.com
workboatmanager.com
silessio.com
abyueche.com
trafficrehab.com
utimake.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1552-6-0x0000000000400000-0x000000000042D000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exedescription pid process target process PID 1044 set thread context of 1552 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exepid process 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 1552 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 1552 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exedescription pid process target process PID 1044 wrote to memory of 836 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe PID 1044 wrote to memory of 836 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe PID 1044 wrote to memory of 836 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe PID 1044 wrote to memory of 1552 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe PID 1044 wrote to memory of 1552 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe PID 1044 wrote to memory of 1552 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe PID 1044 wrote to memory of 1552 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe PID 1044 wrote to memory of 1552 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe PID 1044 wrote to memory of 1552 1044 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe 28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe"{path}"2⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\28adf2e4dcd354d59a63e52a362750a3_JaffaCakes118.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552