Analysis
- max time kernel
121s - max time network
123s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
09/05/2024, 12:28
General
- Target 29f92283750de72e762be0defcaaf7bc_JaffaCakes118.exe
- Size 272KB
- Sample240509-pnsfcacd52
- SHA256 214252466a63120c1473180e5f4d2558f59a6a12aa8f3c38d3d5f45712965d7c
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
3.8
Campaign
-
mk
Decoy
-
push-notifications.net
-
riopumpen.com
-
tourniquetleash.com
-
webjobsource.com
-
lovelouevents.com
-
exesac.com
-
zodiacleagues.com
-
detoutespetiteschoses.com
-
canondrop.com
-
588pz.com
-
townsvillewomenmarketplace.com
-
caramaschitopquality.com
-
1lrl.com
-
fg-lawchambers.com
-
sdbeishida.com
-
puregarciniacambogia.store
-
virtualcurrency.loan
-
retinaonline.store
-
memesclothes.com
-
wineflash.net
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\29f92283750de72e762be0defcaaf7bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\29f92283750de72e762be0defcaaf7bc_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29f92283750de72e762be0defcaaf7bc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\29f92283750de72e762be0defcaaf7bc_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1768-4-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1768-8-0x0000000000770000-0x0000000000A73000-memory.dmp
memory/3028-3-0x00000000005B0000-0x00000000006B0000-memory.dmp
memory/3028-5-0x00000000775E0000-0x00000000776B6000-memory.dmp