Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 10:22
Static task
static1
Behavioral task
behavioral1
Sample
2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe
-
Size
472KB
-
MD5
2ea720e08d23620eec19036e1e019fde
-
SHA1
e125ebf7c78ab570425a496482797c46783bc3c6
-
SHA256
c2b83fb9b026ac37aaa0fa3599494f848c7d2ecd4da2493e6842fba00b31dba0
-
SHA512
ce91403211d6b03bde8b94bcd0d961e7685b8d34e506882b96d58fea9234a4a48038eab5828a2ea349325a970032ce7b8f3e167233091b67785d3f9ef95992eb
-
SSDEEP
6144:HfiZD08oqA7ik/P0QQnSoQ/NITl0OdjNSImQl2t88gfw3FU76wF:HfxHqAek/GS7BQYIp2t88XVUnF
Malware Config
Extracted
formbook
3.9
sl
man085.com
splnkr.com
ecogasuk.com
chefdominick.com
gopay.site
littlehootyoga.com
xmhailibu.com
maerz-it.com
garrongoshen.com
mstestlabo2.online
thepatioideas.com
loftiscpa.net
p3juices.com
knot-experts.win
hell.enterprises
luisa-anderson.com
transporterivas.com
lispic.com
admiralswitch.win
onionscreative.com
texashoperx.com
viama.net
warento.com
turkishjournal.net
mircscriptsfrfm.com
nkjinyuan.com
service-jp.info
ceylonbooker.com
wwwhjc575.com
socialmediatrendspotting.com
marshstant.com
salon-beauty.com
obpcku.info
thesinophile.com
yicixingshoutao.com
spiritualistwritings.com
halftimevacation.com
privacyby.business
mimirai.net
carrepareservices.info
transxaction.com
990350.top
peptidworld.com
enterprisesbylgr.com
metrogroupdevelopment.net
olympiawedding.com
jeza.ltd
yingshiyikao.com
malagafab.com
goticmon.com
observatoryprobe2.info
jewelryisaqe.info
rgbornze.com
puravidabook.info
blackisanuance.com
wordshoesvip.com
christianproofreaders.com
drnarcistherapy.net
adwokatprawnik.com
secureinfowellsfargoalrt.com
bedrohungsmanagement.store
5546uu.com
videuzz.com
ankabutaliraq.com
bolipy.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2988-5-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exedescription pid process target process PID 1924 set thread context of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exepid process 2988 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exepid process 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exepid process 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exepid process 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exedescription pid process target process PID 1924 wrote to memory of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe PID 1924 wrote to memory of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe PID 1924 wrote to memory of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe PID 1924 wrote to memory of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe PID 1924 wrote to memory of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe PID 1924 wrote to memory of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe PID 1924 wrote to memory of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe PID 1924 wrote to memory of 2988 1924 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe 2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2ea720e08d23620eec19036e1e019fde_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2988