Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 18:02

General

  • Target

    2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe

  • Size

    458KB

  • MD5

    2b339850ba96bb3c8308c70acd7ac521

  • SHA1

    4c497319129abac43989a7a75c4ff8d3fee9554e

  • SHA256

    2040586dd9fea01ac08b13748962e9c7ec2bebd618d92543f260984b2eebc352

  • SHA512

    bba4a5d960e100295b7e2c33edfbc2e922ca12a92d43a7ec122f4d2dec33579abd38e4ef69134ed8e35bbbb8cc83efcaf7e67f1f5f2dfa6fc4c54bcd29eea401

  • SSDEEP

    12288:OSLFxvaN9Se5U17u1KFHeSJ7zdGUvVbCY:rFI9UqKNeSJ7zdGUB

Malware Config

Extracted

Family

formbook

Version

3.9

Campaign

vi

Decoy

thehealingcentersintl.com

moiuc.com

foundationtsecuritysn.win

dmorganconstruction.com

rcyg-luxgen.com

xn--9iqxb19lb98e.com

method19baseball.com

caitlinsculpts.com

xn--tpqt61am2s90v.com

clu2007.com

avto-4x4.com

newcode315.com

earnshort.com

instamanga.click

entruempelungs.taxi

brownpaperitckets.com

prepster-inc.com

espacoredator.com

pacificartspublishing.com

ekohelper.net

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:3544
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:2560
    • C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2b339850ba96bb3c8308c70acd7ac521_JaffaCakes118.exe

    Filesize

    458KB

    MD5

    2b339850ba96bb3c8308c70acd7ac521

    SHA1

    4c497319129abac43989a7a75c4ff8d3fee9554e

    SHA256

    2040586dd9fea01ac08b13748962e9c7ec2bebd618d92543f260984b2eebc352

    SHA512

    bba4a5d960e100295b7e2c33edfbc2e922ca12a92d43a7ec122f4d2dec33579abd38e4ef69134ed8e35bbbb8cc83efcaf7e67f1f5f2dfa6fc4c54bcd29eea401

  • memory/744-10-0x0000000004B30000-0x0000000004B3C000-memory.dmp

    Filesize

    48KB

  • memory/744-14-0x0000000006310000-0x00000000063AC000-memory.dmp

    Filesize

    624KB

  • memory/744-9-0x0000000005D60000-0x0000000006304000-memory.dmp

    Filesize

    5.6MB

  • memory/744-4-0x0000000004B80000-0x0000000004BE6000-memory.dmp

    Filesize

    408KB

  • memory/744-5-0x0000000074640000-0x0000000074DF0000-memory.dmp

    Filesize

    7.7MB

  • memory/744-6-0x0000000004E00000-0x0000000004FC2000-memory.dmp

    Filesize

    1.8MB

  • memory/744-7-0x0000000004B10000-0x0000000004B1A000-memory.dmp

    Filesize

    40KB

  • memory/744-8-0x0000000004C60000-0x0000000004C82000-memory.dmp

    Filesize

    136KB

  • memory/744-3-0x0000000000B00000-0x0000000000B2C000-memory.dmp

    Filesize

    176KB

  • memory/744-0-0x000000007464E000-0x000000007464F000-memory.dmp

    Filesize

    4KB

  • memory/744-12-0x0000000074640000-0x0000000074DF0000-memory.dmp

    Filesize

    7.7MB

  • memory/744-11-0x000000007464E000-0x000000007464F000-memory.dmp

    Filesize

    4KB

  • memory/744-13-0x0000000005C40000-0x0000000005C4C000-memory.dmp

    Filesize

    48KB

  • memory/744-2-0x0000000004A70000-0x0000000004B02000-memory.dmp

    Filesize

    584KB

  • memory/744-18-0x0000000074640000-0x0000000074DF0000-memory.dmp

    Filesize

    7.7MB

  • memory/744-1-0x0000000000080000-0x00000000000F8000-memory.dmp

    Filesize

    480KB

  • memory/4516-15-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4516-19-0x00000000015B0000-0x00000000018FA000-memory.dmp

    Filesize

    3.3MB

  • memory/4516-20-0x00000000015B0000-0x00000000018FA000-memory.dmp

    Filesize

    3.3MB