Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
16/05/2024, 17:19
General
- Target 4c31e943383ee0531c4d01efd6002dfe_JaffaCakes118.exe
- Size 548KB
- Sample240516-vvs84sfd78
- SHA256 cc1e8359121d2475312eeca99597514d37befd1f3a83325dcf431a90eda9392f
Score
10/10
Malware Config
Extracted
Family
-
formbook
Version
-
3.9
Campaign
-
j01
Decoy
-
technodjmix.com
-
publishsports.com
-
lebo777.net
-
delzellcapstone.com
-
demifengye.com
-
gjwbi.com
-
cheapflight.today
-
melibaviaggi.com
-
libertyfallen.site
-
facebookconference.com
-
whipznwheelz.info
-
windbox.review
-
cttbh.com
-
liftrakmoradi.com
-
lovsdi.com
-
soulchakradesign.com
-
playpharmacy.online
-
paknationalists.info
-
mrloquacious.com
-
artbusiness.review
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c31e943383ee0531c4d01efd6002dfe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c31e943383ee0531c4d01efd6002dfe_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4496-2-0x0000000003A60000-0x0000000003B60000-memory.dmp
memory/4496-3-0x0000000000400000-0x000000000048D000-memory.dmp
memory/4496-4-0x0000000076EC1000-0x0000000076FE1000-memory.dmp
memory/4496-5-0x000000000C100000-0x000000000C44A000-memory.dmp
memory/4496-8-0x0000000003A60000-0x0000000003B60000-memory.dmp