Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 09:25
Behavioral task
behavioral1
Sample
540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
General
- Target 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe
- Size 727KB
- Sample240518-ldvk6sdc98
- SHA256 999f1f5b2c273f90b82ef65ae5e1e0ad4bbfb8612eb97ef9217f782ddd587c06
- MD5 540cc0848059d473dc51b3160d9629df
- SHA1 9591f93de3c8e77f3bd35e00bd7289f617471408
- SHA512 f1286a1da339bfe0a42f007f2e7c0ba722650f38d9b6a3916d4882630bf2a3fd84e62698f1bda8056bd94cebd050adcf36354a4dd2df6271ffd10e7c9a37903d
- SSDEEP 12288:SYV6MorX7qzuC3QHO9FQVHPF51jgcEzhvw4hu345psuQP11SOZjm//k:hBXu9HGaVHEjhu3OpsuQP11SWjmU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
formbook
Version
-
3.9
Campaign
-
wo
Decoy
-
bcmigt.com
-
spiraltowellness.com
-
n1112.com
-
zhangyuping8.com
-
mthopehauntedhayride.com
-
heseniorlivingnow.live
-
ironkalip.com
-
ebookadmin.com
-
jacobssf.net
-
whosdownnewyork.com
-
8uwxb7b-7yxl754.com
-
bees.reisen
-
xn--y8jte7b913sqdjhiam386a.com
-
fixallthefiles.com
-
zimagazine.com
-
stylelesh.com
-
burnque.com
-
blogbelezafeminina.info
-
rbnbtzf.info
-
lifeoflin.com
-
legallguillaume.com
-
cgrsmi.com
-
i-car.group
-
gzshfs.net
-
mydigitalart.net
-
repair-help-frankfurt.com
-
topqualitywesterngear.com
-
kiwitiny.com
-
rdfinsaat.com
-
freeprojectalert.info
-
timegallery.online
-
jiaowomj.com
-
technoforall.com
-
inspired7.com
-
mcurls.com
-
cwvomc1dkh.com
-
centrey.com
-
jvfaql.tech
-
merkur-fracht.com
-
empireusa.info
-
emelina.live
-
easybookmarkings.win
-
nvzhifu.com
-
almalik-host.com
-
umrohpintar.com
-
holisticlifevacations.com
-
giantjx.com
-
stir.social
-
kazoman.com
-
cherylluquire.com
-
trendsetterliving.net
-
kmsgnk120.com
-
xxvi.business
-
purplalk.com
-
bushelpeckneck.com
-
parknload.info
-
kwekabaw.com
-
fg176.net
-
inframespecs.com
-
heatpay0011.com
-
drdrapeblinds.com
-
albanyinspectionservices.com
-
bestmatrimonialscripts.com
-
popkitchenseattle.com
-
menflax.com
Signatures
- Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/640-2-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral2/memory/640-8-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
resource yara_rule behavioral2/memory/3980-0-0x0000000000C10000-0x0000000000DA7000-memory.dmp upx behavioral2/memory/3980-6-0x0000000000C10000-0x0000000000DA7000-memory.dmp upx - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3980-6-0x0000000000C10000-0x0000000000DA7000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3980 set thread context of 640 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 82 PID 640 set thread context of 3472 640 svchost.exe 56 PID 5004 set thread context of 3472 5004 rundll32.exe 56 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 640 svchost.exe 640 svchost.exe 640 svchost.exe 640 svchost.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe 5004 rundll32.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 640 svchost.exe 640 svchost.exe 640 svchost.exe 5004 rundll32.exe 5004 rundll32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 640 svchost.exe Token: SeDebugPrivilege 5004 rundll32.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3980 wrote to memory of 640 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 82 PID 3980 wrote to memory of 640 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 82 PID 3980 wrote to memory of 640 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 82 PID 3980 wrote to memory of 640 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 82 PID 3980 wrote to memory of 640 3980 540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe 82 PID 3472 wrote to memory of 5004 3472 Explorer.EXE 85 PID 3472 wrote to memory of 5004 3472 Explorer.EXE 85 PID 3472 wrote to memory of 5004 3472 Explorer.EXE 85 PID 5004 wrote to memory of 4368 5004 rundll32.exe 91 PID 5004 wrote to memory of 4368 5004 rundll32.exe 91 PID 5004 wrote to memory of 4368 5004 rundll32.exe 91
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\540cc0848059d473dc51b3160d9629df_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵PID:4368
-
-