Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
09/05/2024, 18:11
General
- Target 2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118.exe
- Size 745KB
- Sample240509-wsnfhsfe7w
- SHA256 82f4ebd30b18743d8cc409de5931a978434755705af9bbfa3c6d8d0b34d30a6b
Malware Config
Extracted
-
formbook
-
4.1
-
gtb
-
kbsvipbags.com
-
grandma-salt.com
-
org-id100.info
-
marketobserverllc.com
-
robjmccarthy.com
-
orbitnest.com
-
7d5d.com
-
hotdealsallday.com
-
kaban-shitsuji.com
-
eivisionexport.com
-
luatfv.com
-
creationxbydom.com
-
realjuku.com
-
roast365.com
-
epis2020.com
-
schcman.com
-
xn--pimi-ooa.com
-
jobshustle.com
-
rightnewswire.com
-
seguonra.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 10 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\2b3c4a317d8fc64ca9991aec36624e6d_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1240-16-0x0000000000090000-0x000000000016C000-memory.dmp
memory/1240-17-0x0000000000090000-0x000000000016C000-memory.dmp
memory/2180-15-0x00000000005E0000-0x00000000005EA000-memory.dmp
memory/3460-9-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3460-5-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3460-7-0x0000000002AA0000-0x0000000002DEA000-memory.dmp
memory/3460-10-0x0000000000E60000-0x0000000000E74000-memory.dmp
memory/3516-24-0x0000000009610000-0x00000000097B8000-memory.dmp
memory/3516-28-0x000000000B180000-0x000000000B2EC000-memory.dmp
memory/3516-11-0x0000000009610000-0x00000000097B8000-memory.dmp
memory/3688-25-0x0000000074EAE000-0x0000000074EAF000-memory.dmp
memory/3688-12-0x0000000074EAE000-0x0000000074EAF000-memory.dmp
memory/4440-3-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/4440-2-0x0000000004EC0000-0x0000000004F52000-memory.dmp
memory/4440-1-0x00000000004D0000-0x0000000000590000-memory.dmp
memory/4440-21-0x0000000074EAE000-0x0000000074EAF000-memory.dmp
memory/4440-22-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/4440-4-0x0000000004FD0000-0x000000000500A000-memory.dmp
memory/4440-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp
memory/4440-6-0x0000000074EA0000-0x0000000075650000-memory.dmp