Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 01:59

General

  • Target

    2cc9f4a819185333bc946cbe1c550210_JaffaCakes118.exe

  • Size

    910KB

  • MD5

    2cc9f4a819185333bc946cbe1c550210

  • SHA1

    6ce7d3ee1af2e3ec697dad4002d3b6e9110dba3d

  • SHA256

    2ffe3df675a097fefad87b0c66d028ff6a732dbd67f4385777c4fb52a3e60994

  • SHA512

    98d00d533510bad7fe70383733b90c82df1186871e03360480d5506111dee8b8bfe37844d880084af2d05624e0fcb22fd601a19bc53e6e30f340afdb09dd9856

  • SSDEEP

    24576:oNHCmvI0fjnjOgYwC4U4o5EOYf4yI7OUcaY:wfRLNYwtUD7OKY

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

te

Decoy

sharjo-begir2.xyz

shroomsmy.com

citestpridom20200814092033.net

alemaruy.com

etong-tech.com

lomomofarm.com

elitenailsupplyva.com

thoughtfulbuddhist.online

therealtalkers.com

castleemerald.net

ysksafety.com

amazingrealtors.net

sourcesharp.com

commentorsint.com

alinement-solutions.info

expressivepins.com

americanbullylover.com

calerie.net

poamerican.com

epicoutreach.events

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cc9f4a819185333bc946cbe1c550210_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2cc9f4a819185333bc946cbe1c550210_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aPoVrnLXZTfD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1104
    • C:\Users\Admin\AppData\Local\Temp\2cc9f4a819185333bc946cbe1c550210_JaffaCakes118.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpB7.tmp

    Filesize

    1KB

    MD5

    88f6e47b0f3f9736b361f47193a35c66

    SHA1

    1b4519832f5f58fc4b3cbeff8ee6c65eb66a494d

    SHA256

    b906832c47ab8d2bb9199ee0d1fa2e380e5ed3009a849ab7b4f8621bf6a3741d

    SHA512

    3988918506cb1a8c3eeceb3d2ab42ade8a1cc4e19b9eeab7a516922454380ae80d552d6e64e861327b84a23a40a8333614e4b1d45a197fdd2ca8f70d72cbcc76

  • memory/3384-18-0x0000000001960000-0x0000000001CAA000-memory.dmp

    Filesize

    3.3MB

  • memory/3384-15-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/4532-4-0x00000000052F0000-0x00000000052FA000-memory.dmp

    Filesize

    40KB

  • memory/4532-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

    Filesize

    4KB

  • memory/4532-5-0x0000000074A20000-0x00000000751D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4532-6-0x0000000007C30000-0x0000000007CCC000-memory.dmp

    Filesize

    624KB

  • memory/4532-7-0x00000000064C0000-0x00000000064D2000-memory.dmp

    Filesize

    72KB

  • memory/4532-8-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

    Filesize

    4KB

  • memory/4532-9-0x0000000074A20000-0x00000000751D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4532-10-0x0000000007E00000-0x0000000007E8E000-memory.dmp

    Filesize

    568KB

  • memory/4532-11-0x000000000A600000-0x000000000A67A000-memory.dmp

    Filesize

    488KB

  • memory/4532-3-0x0000000005300000-0x0000000005392000-memory.dmp

    Filesize

    584KB

  • memory/4532-2-0x0000000005810000-0x0000000005DB4000-memory.dmp

    Filesize

    5.6MB

  • memory/4532-17-0x0000000074A20000-0x00000000751D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4532-1-0x0000000000960000-0x0000000000A4A000-memory.dmp

    Filesize

    936KB