Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
12/05/2024, 00:20
General
- Target 37457efcced32d31e537a8e2f5ba24ec_JaffaCakes118.exe
- Size 801KB
- Sample240512-amsbmaad84
- SHA256 786ae09eb45cf51650c879874b1d0d81a08012577adee96bf3c1353bd8ec6235
Malware Config
Extracted
-
formbook
-
3.9
-
pg
-
chinatobelgiumpertrain.com
-
frengeen.com
-
tipiacevincerefacile.bet
-
aniversariosyvacaciones.com
-
crittersitter.care
-
freeformflow.com
-
estxt.com
-
adongchemical.com
-
i1d0zglwq6n.biz
-
undercover-trainer.com
-
olimp-supplement.com
-
fsjuxue.com
-
cash4biz.loan
-
theboulderhousenevadacity.com
-
theindianstores.com
-
crescentdetailing.com
-
emslvy.com
-
remeshkoff.com
-
hizliporno.info
-
nanny8024.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37457efcced32d31e537a8e2f5ba24ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\37457efcced32d31e537a8e2f5ba24ec_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\37457efcced32d31e537a8e2f5ba24ec_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\37457efcced32d31e537a8e2f5ba24ec_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1284-4-0x0000000006380000-0x0000000006924000-memory.dmp
memory/1284-13-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/1284-2-0x0000000001920000-0x0000000001932000-memory.dmp
memory/1284-3-0x0000000005CB0000-0x0000000005D42000-memory.dmp
memory/1284-6-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/1284-5-0x0000000005DD0000-0x0000000005E14000-memory.dmp
memory/1284-8-0x00000000060B0000-0x0000000006116000-memory.dmp
memory/1284-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp
memory/1284-1-0x0000000000FF0000-0x00000000010BE000-memory.dmp
memory/1284-9-0x0000000007830000-0x00000000078CC000-memory.dmp
memory/1284-7-0x0000000074EEE000-0x0000000074EEF000-memory.dmp
memory/1284-12-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/1836-10-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1836-14-0x00000000015D0000-0x000000000191A000-memory.dmp