Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 15:22

General

  • Target

    2a9a30eec97ab00aa5383eb5b7b39e4c_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    2a9a30eec97ab00aa5383eb5b7b39e4c

  • SHA1

    4e557ee5f1c71f649ec7c700d4d8582bce462db3

  • SHA256

    61c879a82dd2352181a729b07d05a8d4c871a120a1ca69a673892b7ecb5b95c1

  • SHA512

    fdc1dc6795d746be2a695498d718b88f3debebe636f4fbef7b7858dfb64ed3a9f1aebf29287a1d880aa0ac1f05f410ebc9097de8a5501020e3e309677dc1387b

  • SSDEEP

    12288:Dvm7Ib5morl71BT1c2rtHCaDKUdaKAM9J1VyAtR9jphJYIcjdLtophIm9wIdAksQ:Uri1fHhH2MM+9VXfpC0w2AM2m

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

l7

Decoy

water360.net

mantle-liquid.com

crypto1st.com

zhangying7.com

macsupportusa.online

hellocellular.online

linkhay.info

equipoprofesional.online

happyholi2017.com

halobuilders.net

gaelleautin.com

kateklamer.com

keyarmor.com

sandamall.com

livifyfe.com

pkmuxb.ink

precios10.com

baitongjxgs.com

pinnacle175.com

dlpansr.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a9a30eec97ab00aa5383eb5b7b39e4c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2a9a30eec97ab00aa5383eb5b7b39e4c_JaffaCakes118.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Users\Admin\AppData\Local\Temp\2a9a30eec97ab00aa5383eb5b7b39e4c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\2a9a30eec97ab00aa5383eb5b7b39e4c_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2236-10-0x0000000001F80000-0x0000000001F81000-memory.dmp

    Filesize

    4KB

  • memory/2236-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2236-5-0x00000000003A0000-0x00000000003A1000-memory.dmp

    Filesize

    4KB

  • memory/2236-12-0x00000000020D0000-0x00000000020D1000-memory.dmp

    Filesize

    4KB

  • memory/2236-9-0x0000000000380000-0x0000000000381000-memory.dmp

    Filesize

    4KB

  • memory/2236-3-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2236-2-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2236-1-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2236-0-0x0000000000400000-0x0000000000565000-memory.dmp

    Filesize

    1.4MB

  • memory/2236-11-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

    Filesize

    4KB

  • memory/2236-7-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2236-8-0x0000000000330000-0x0000000000372000-memory.dmp

    Filesize

    264KB

  • memory/2236-6-0x0000000000390000-0x0000000000391000-memory.dmp

    Filesize

    4KB

  • memory/2236-13-0x0000000000400000-0x0000000000565000-memory.dmp

    Filesize

    1.4MB

  • memory/2236-14-0x0000000000330000-0x0000000000372000-memory.dmp

    Filesize

    264KB

  • memory/2236-16-0x00000000020D0000-0x00000000020D1000-memory.dmp

    Filesize

    4KB

  • memory/2236-17-0x0000000000400000-0x0000000000565000-memory.dmp

    Filesize

    1.4MB

  • memory/2236-24-0x0000000000400000-0x0000000000565000-memory.dmp

    Filesize

    1.4MB

  • memory/2752-22-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2752-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2752-18-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB