Analysis
-
max time kernel
148s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 11:44
Static task
static1
Behavioral task
behavioral1
Sample
5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe
-
Size
237KB
-
MD5
5ee46295b565a80943c79c4adee9dec7
-
SHA1
088040d934fc1f30424def22adf3a8063c09bfda
-
SHA256
092604ea968c54cd13c04fe2e85a4f5ec9e5b6ad5c83577160d1108c69156bf2
-
SHA512
b77b40775ef3581f8d6dade14d8672cf55c9e433c76956a59182e3d01971f6e5209d5e3ed30ba0bd989d73aa9d3956b0dc8bd99427c5179f9c4e7efb9824b406
-
SSDEEP
6144:VIH3fprvmAlYazYP+FqKfr0w6T+J0qwHkbAhfUKE6R3o:OXxuCYaFZB07QA+K3J
Malware Config
Extracted
formbook
4.1
b4630
touchlessfund.com
tokenizemortgage.com
suninfosystem.net
eugeneskeef.com
comprindoameta.com
simonhousecopake.com
mastergrannyflats.net
hocahanim-dogalurunler.com
skoolsoftware.com
remoteittrainer.com
digitalchurchchallenge.com
poslenastishina.com
officialamandacoppotelli.com
nomadadventuretours.com
prayforlouisiana.com
prochain.finance
heroesrisingtocurecancer.com
caresalt.com
vizslatshirt.com
defengineer.com
timberlandshoecanada.com
newyork-islanders.com
amevision.com
theezsuite.com
osez-bio.com
rjthestoryguy.com
blkmagiklabs.com
reallifecam.plus
hmeliamkt.com
minnitech.com
studesport.com
buyranitidine.com
yumejapaneserestaurant.com
24horas-telefono-11840.com
localcovidtests.com
pentagonconveyors.com
digimarceting.com
nextstepshow.com
movielaunch.xyz
aubreyhansfieldschultz.com
cafetrader.net
barathealth.com
nosnails.com
boomanddoneskincare.com
woodform.store
halinvaktinyerinde05.com
eewin-vip.com
johnpaoletti.net
daytripsmorocco.com
regular-list.info
ifoolky.com
balenciagaonmarket.com
gaileo.international
divingintoadventure.com
joaomkt.com
candytoys.net
lfjjmkyha.icu
khosimdep.online
liquidlightningsports.com
cucurumbel.com
cityfishseafoodgrill.com
watchthatclass.com
alappletryne.info
masterparket.com
omaitopal.com
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1508-8-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1508-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exevbc.exeraserver.exedescription pid process target process PID 1608 set thread context of 1508 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe vbc.exe PID 1508 set thread context of 3516 1508 vbc.exe Explorer.EXE PID 4620 set thread context of 3516 4620 raserver.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exevbc.exeraserver.exepid process 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe 1508 vbc.exe 1508 vbc.exe 1508 vbc.exe 1508 vbc.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe 4620 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeraserver.exepid process 1508 vbc.exe 1508 vbc.exe 1508 vbc.exe 4620 raserver.exe 4620 raserver.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exevbc.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe Token: SeDebugPrivilege 1508 vbc.exe Token: SeDebugPrivilege 4620 raserver.exe Token: SeShutdownPrivilege 3516 Explorer.EXE Token: SeCreatePagefilePrivilege 3516 Explorer.EXE Token: SeShutdownPrivilege 3516 Explorer.EXE Token: SeCreatePagefilePrivilege 3516 Explorer.EXE Token: SeShutdownPrivilege 3516 Explorer.EXE Token: SeCreatePagefilePrivilege 3516 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3516 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exeExplorer.EXEraserver.exedescription pid process target process PID 1608 wrote to memory of 1508 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe vbc.exe PID 1608 wrote to memory of 1508 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe vbc.exe PID 1608 wrote to memory of 1508 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe vbc.exe PID 1608 wrote to memory of 1508 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe vbc.exe PID 1608 wrote to memory of 1508 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe vbc.exe PID 1608 wrote to memory of 1508 1608 5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe vbc.exe PID 3516 wrote to memory of 4620 3516 Explorer.EXE raserver.exe PID 3516 wrote to memory of 4620 3516 Explorer.EXE raserver.exe PID 3516 wrote to memory of 4620 3516 Explorer.EXE raserver.exe PID 4620 wrote to memory of 3312 4620 raserver.exe cmd.exe PID 4620 wrote to memory of 3312 4620 raserver.exe cmd.exe PID 4620 wrote to memory of 3312 4620 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5ee46295b565a80943c79c4adee9dec7_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-8-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1508-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1508-12-0x0000000001160000-0x0000000001174000-memory.dmpFilesize
80KB
-
memory/1508-9-0x0000000001700000-0x0000000001A4A000-memory.dmpFilesize
3.3MB
-
memory/1608-5-0x0000000074C50000-0x0000000075400000-memory.dmpFilesize
7.7MB
-
memory/1608-14-0x0000000074C5E000-0x0000000074C5F000-memory.dmpFilesize
4KB
-
memory/1608-6-0x0000000005380000-0x000000000538A000-memory.dmpFilesize
40KB
-
memory/1608-7-0x0000000005430000-0x000000000543A000-memory.dmpFilesize
40KB
-
memory/1608-4-0x0000000005120000-0x000000000512A000-memory.dmpFilesize
40KB
-
memory/1608-3-0x0000000005170000-0x0000000005202000-memory.dmpFilesize
584KB
-
memory/1608-2-0x0000000005680000-0x0000000005C24000-memory.dmpFilesize
5.6MB
-
memory/1608-1-0x0000000000710000-0x0000000000752000-memory.dmpFilesize
264KB
-
memory/1608-20-0x0000000074C50000-0x0000000075400000-memory.dmpFilesize
7.7MB
-
memory/1608-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmpFilesize
4KB
-
memory/1608-18-0x0000000074C50000-0x0000000075400000-memory.dmpFilesize
7.7MB
-
memory/3516-13-0x0000000003550000-0x0000000003607000-memory.dmpFilesize
732KB
-
memory/3516-22-0x0000000003550000-0x0000000003607000-memory.dmpFilesize
732KB
-
memory/3516-25-0x0000000007950000-0x00000000079ED000-memory.dmpFilesize
628KB
-
memory/3516-27-0x0000000007950000-0x00000000079ED000-memory.dmpFilesize
628KB
-
memory/3516-30-0x0000000007950000-0x00000000079ED000-memory.dmpFilesize
628KB
-
memory/4620-17-0x0000000000240000-0x000000000025F000-memory.dmpFilesize
124KB
-
memory/4620-15-0x0000000000240000-0x000000000025F000-memory.dmpFilesize
124KB