Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 18:25
Behavioral task
behavioral1
Sample
608b3c7d4092ba03e8393c5b6102cc34_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
608b3c7d4092ba03e8393c5b6102cc34_JaffaCakes118.exe
-
Size
688KB
-
MD5
608b3c7d4092ba03e8393c5b6102cc34
-
SHA1
5f81869f67b5376317e496447431cc0e1924f2f9
-
SHA256
75126a9e47774b66c23d7bee87c4b1fdb2be6abc37b28d65eb842324956cd8f5
-
SHA512
ebc34a35436ca07ac3687d1841946a7ffc4e3556cfe498f5d9ef6ac410cfab82e49c77ba94d03f364934f136660b6db0a5788563da8c0ebf1170c853800f3725
-
SSDEEP
12288:SIfeAaArx2xis71SNHHF9VDc7/PXJ93zsWmNSZk:H93Gi1FjsXJ934dNSZ
Malware Config
Extracted
formbook
3.8
l5
riverchaseapts.net
0430pe.com
nbgift.net
ehkhwn.win
immatthall.com
fkslc.info
breakthroughmediadon.com
eatorganic.life
okcitytowing.com
egaodomain.com
krenbc.com
lavi.ltd
sport-score.com
romskicentar.com
junkyard.design
xn--55q83b758aihq.com
phonerepairlocal.com
5656868.com
1s7onework.men
elizabethreidinteriordesign.com
wajarajalah.com
jaimelesasiatiques.com
physicaltradingprep.com
hyishen.com
parklbridge.com
mayasnature.com
725emeraldbay.com
xnhbyh.net
yayasan-bahrululum.com
gladiatorsofwellness.com
iotsmartlighting.com
0509k.com
alejandrogaxiolacoppel.com
karoai.com
domainengel.com
retraitepep.com
revolutionapex.com
ppr.ink
office-futamoto.com
coinfor.life
my-synfigo.com
spotstore.review
findsyouwell.com
preimersports.com
beunremarkable.com
landes-ocean-vielle.com
toyopika.com
worldmtv.com
chinaqdl.com
phunquesdesk.com
clubsena.info
lubb82821.com
sandyofipswich.com
schoolyardsigns.com
jerritbates.com
coalboilertypes.com
findyourfinancialfreedom.net
wakacjeludu.info
modifiedhealth.com
rootsmarketing.co.uk
swiftstreamerz.com
janym.info
aowing.com
turbo-marketing.co.uk
91ruitue.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2384-3-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Processes:
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x0000000000659000-memory.dmp upx behavioral1/memory/2384-1-0x0000000000400000-0x0000000000659000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
608b3c7d4092ba03e8393c5b6102cc34_JaffaCakes118.exepid process 2384 608b3c7d4092ba03e8393c5b6102cc34_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
608b3c7d4092ba03e8393c5b6102cc34_JaffaCakes118.exepid process 2384 608b3c7d4092ba03e8393c5b6102cc34_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2384-0-0x0000000000400000-0x0000000000659000-memory.dmpFilesize
2.3MB
-
memory/2384-1-0x0000000000400000-0x0000000000659000-memory.dmpFilesize
2.3MB
-
memory/2384-2-0x0000000001E20000-0x0000000001E21000-memory.dmpFilesize
4KB
-
memory/2384-3-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2384-5-0x0000000003910000-0x0000000003C13000-memory.dmpFilesize
3.0MB
-
memory/2384-6-0x0000000003910000-0x0000000003C13000-memory.dmpFilesize
3.0MB