Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
18-05-2024 07:27
General
-
Target
5396b22800da1f1c7528ae67a5fe011d_JaffaCakes118.exe
-
Size
336KB
-
MD5
5396b22800da1f1c7528ae67a5fe011d
-
SHA1
4fdd0248152166f9821e8e447476d595740dae7f
-
SHA256
fd37a492eb083eb43dfd53cf28f0a0840e1bab5a68937080d764ea4df9f90945
-
SHA512
31b407d54af8f8966403c79b3fcd251e4c99d26d693d6774564800f862920cea7f9d3e4a68141512b5aab87b170fde6ad06b656151a7937bd816a1c0591fdd4b
-
SSDEEP
6144:BsKxheSkTu7k0XwWcmoO1HvfvCXRSq40wO8qxtW2HXkZ:BsuheSeuY0glm31/CXT4hgA2HXkZ
Malware Config
Extracted
formbook
3.8
ca
tirtatv.com
thefinalreviews.com
lakesidesrealtor.net
jilinjijin.com
packfreshcannabis.com
mohammedfakiha.com
oilxl.info
xn--doqu1wc86axnn.com
core-marlk.com
truyenvoz.info
ptamed.com
y31000.com
tredaily.com
jsaswkj.com
xiunan.net
panaceagluta.com
kenanalifd.com
0513gx.com
kpdvk04wr3.biz
riobaretanning.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5396b22800da1f1c7528ae67a5fe011d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5396b22800da1f1c7528ae67a5fe011d_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
168KB
-
Filesize
856KB
-
Filesize
1.1MB
-
Filesize
3.0MB
-
Filesize
3.0MB