Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 01:15
Static task
static1
Behavioral task
behavioral1
Sample
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe
-
Size
516KB
-
MD5
2ca017b13019947be76b449d41dcde31
-
SHA1
2af1788f590ffdc3468d454eea212a0da9ff9191
-
SHA256
bb54b67f3738a2044afe0c98327743390a61c4ffaac952610733e3e2677593a5
-
SHA512
38944a948820ec09e5a2b505ccd6c092f38d3a8dacc15405f11b0b2a5030fba1967305c2768661b3be185ac37c55238b40cb7f2bcbf58d7022cdbbeaee63e0d0
-
SSDEEP
3072:MzjXUW4qcmdYo21pqVx7l1tDRhh3F8ZzpWXDSJjCvL0Lmm4ikos7GXpULenWXEwS:MfEW4qg5E3/OZtyWJevitkF/Lenkm
Malware Config
Extracted
formbook
3.9
rm
21031venturablvd.com
hakunaamatata.com
favoritetrafficupdates.review
supermetaldetector.com
emprendiendoconvalor.com
instantclearskincream.com
quality-ind.com
essarp.net
citywidelbanks.com
actoralbert.com
melendyou.com
yfmodelminiatures.com
sell4cashwylie.com
lycheetreecottage.com
shoppingforbeatsearbuds.com
dgfengkai.com
dottowels.com
thxhva.info
oneloveworship.com
springfordschooldistrict.com
aplockinge.com
reframinglexicon.com
restnowpartylater.com
nowmedia.group
ahxx.ink
ziwojianding.net
rizqtechengineers.com
xuat-tinh-som.net
trakyagaming.com
thewildsoulsage.com
digitalsoldiers.software
yahoomediallc.net
tyrrh.com
ecoisticprotein.com
michaokeji.com
movin3d.com
peluquerialasdominicanas.com
rasiohead.com
wwwm59999.com
qrmeter.com
captionestimate.net
couriers.wales
mint-pro.com
toothwr.com
sardocucina.com
archive-fast.date
24hrpants.com
pawfect4u.com
nathalie-beauty.com
ree.guru
styledstagedsold.biz
tzfst.com
myrecipecritic.com
168cp149.com
f1-timez.com
alphaeducon.com
myownreader.com
779bifa.com
wheretofindhotnews.com
express-verification.com
makeitadouble40.com
viaggiareinliberta.com
diamondxxx.com
55rfya.com
higcaf.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3020-1-0x0000000000C00000-0x0000000000C82000-memory.dmp formbook -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2440 3020 WerFault.exe 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exepid process 3020 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2ca017b13019947be76b449d41dcde31_JaffaCakes118.exedescription pid process target process PID 3020 wrote to memory of 2440 3020 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe WerFault.exe PID 3020 wrote to memory of 2440 3020 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe WerFault.exe PID 3020 wrote to memory of 2440 3020 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe WerFault.exe PID 3020 wrote to memory of 2440 3020 2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ca017b13019947be76b449d41dcde31_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 1842⤵
- Program crash
PID:2440