Overview
overview
10Static
static
3671c2e2710...18.exe
windows7-x64
10671c2e2710...18.exe
windows10-2004-x64
10$APPDATA/o...60.dll
windows7-x64
1$APPDATA/o...60.dll
windows10-2004-x64
1$APPDATA/o...60.dll
windows7-x64
1$APPDATA/o...60.dll
windows10-2004-x64
1$APPDATA/o...60.dll
windows7-x64
1$APPDATA/o...60.dll
windows10-2004-x64
1$APPDATA/o...60.dll
windows7-x64
1$APPDATA/o...60.dll
windows10-2004-x64
1$APPDATA/o...Vb.dll
windows7-x64
1$APPDATA/o...Vb.dll
windows10-2004-x64
1$APPDATA/o...nu.dll
windows7-x64
1$APPDATA/o...nu.dll
windows10-2004-x64
1$APPDATA/v...60.dll
windows7-x64
1$APPDATA/v...60.dll
windows10-2004-x64
1$APPDATA/v...UI.dll
windows7-x64
1$APPDATA/v...UI.dll
windows10-2004-x64
1$APPDATA/v...rc.dll
windows7-x64
1$APPDATA/v...rc.dll
windows10-2004-x64
1$APPDATA/v...ui.dll
windows7-x64
1$APPDATA/v...ui.dll
windows10-2004-x64
1$TEMP/Kine...ph.dll
windows7-x64
1$TEMP/Kine...ph.dll
windows10-2004-x64
1$TEMP/boondocks.exe
windows7-x64
3$TEMP/boondocks.exe
windows10-2004-x64
10$TEMP/cust...60.dll
windows7-x64
1$TEMP/cust...60.dll
windows10-2004-x64
1$TEMP/cust...re.dll
windows7-x64
1$TEMP/cust...re.dll
windows10-2004-x64
1$TEMP/cust...UI.dll
windows7-x64
1$TEMP/cust...UI.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 11:31
Static task
static1
Behavioral task
behavioral1
Sample
671c2e2710c301a026919308026c7865_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
671c2e2710c301a026919308026c7865_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$APPDATA/operations/21.opends60.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$APPDATA/operations/21.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$APPDATA/operations/31.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$APPDATA/operations/31.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$APPDATA/operations/32.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$APPDATA/operations/32.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$APPDATA/operations/63.opends60.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
$APPDATA/operations/63.opends60.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$APPDATA/operations/MicrosoftVsaVb.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$APPDATA/operations/MicrosoftVsaVb.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$APPDATA/operations/vbamnu.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$APPDATA/operations/vbamnu.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$APPDATA/var/decoder/3.opends60.dll
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
$APPDATA/var/decoder/3.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$APPDATA/var/decoder/VB7TLDUI.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
$APPDATA/var/decoder/VB7TLDUI.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
$APPDATA/var/decoder/msdatasrc.dll
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$APPDATA/var/decoder/msdatasrc.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$APPDATA/var/decoder/msdnmui.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$APPDATA/var/decoder/msdnmui.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
$TEMP/Kinematograph.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
$TEMP/Kinematograph.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
$TEMP/boondocks.exe
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
$TEMP/boondocks.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
$TEMP/customcode/67.opends60.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
$TEMP/customcode/67.opends60.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
$TEMP/customcode/Culture.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$TEMP/customcode/Culture.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
$TEMP/customcode/MicrosoftDataConnectionUI.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$TEMP/customcode/MicrosoftDataConnectionUI.dll
Resource
win10v2004-20240426-en
General
-
Target
$TEMP/boondocks.exe
-
Size
48KB
-
MD5
f2c010efa41b7f7964f3f7c33d274d2c
-
SHA1
0fa34299cf3cae1f97ce61616481b268fc2d61a4
-
SHA256
1c79fad4da54e50dc05a2ef8b04e650e02dd9e42188aadfd834e64e85c693af0
-
SHA512
722a515ebbba7d381b3630f4696352377274a02e804e465900eaad32099c57ce89fb9703444372ac5c97f75ca387e906cd51000ed3aa1fa85606024e41eac3ae
-
SSDEEP
768:I+R6xxPZE++fy7Hm9qkYonPWvbD+z4Et7:ie+C9q0nPZ9t7
Malware Config
Extracted
formbook
3.9
a8c
kesslergroupinternational.net
elcarretazo.com
livbim.info
thamxop.net
abitur.expert
cidavidjoy.com
digitalkarwaan.com
hcave.com
foundbyjack.com
servicarpasjc.com
giaotrinh24h.com
ladasno.com
harrisxn.com
bestbtccasinos.info
australianflying.com
louboutinshoes.site
taohaomi.net
s5league-europe.com
lizhongysw.com
imizuspotsboxboxinggym.com
monterroportal.com
omegaadvisory.info
globaldigitalprohub.com
rocketradiolegends.com
botafogousa.com
lefthandchurch.com
10-2johnsonstreetnorthcote.com
646frj.faith
chinalihe.com
cttexpresso292738.site
uncoveredforums.com
torpedo-ab.com
merchantlightingconsultants.com
llfireworks.com
champa-chameli.com
costus-marin.com
hecvision.com
drgrsdgrr.com
aussieducation.com
zulufaces.com
sdoykz.com
digitalmarketingpartnerz.com
margaretbialis.com
qiehao.online
thinkingcustard.com
emerya.win
junenng-zh.com
xn--0lq70ehybmwhzx1h.com
mbchurch.live
catcurios.com
waisttrainner.com
tragedel.com
4e73.com
chasingsdgs.com
michaelboydatlanta.com
thubnailseries.com
wanli118.com
wongelectric.net
gydsyj.com
onesquare-trust.com
wlqp55.com
cbmissionfund.com
allianxgroup.com
blessedladyoutlet.com
nyoxibwer.com
Signatures
-
Formbook payload 3 IoCs
Processes:
resource yara_rule behavioral26/memory/2108-11-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral26/memory/2108-13-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral26/memory/2108-14-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cmd.exedescription pid process target process PID 2108 set thread context of 3460 2108 cmd.exe Explorer.EXE PID 2108 set thread context of 3460 2108 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
boondocks.execmd.exepid process 4880 boondocks.exe 2108 cmd.exe 2108 cmd.exe 2108 cmd.exe 2108 cmd.exe 2108 cmd.exe 2108 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
boondocks.execmd.exepid process 4880 boondocks.exe 2108 cmd.exe 2108 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cmd.exedescription pid process Token: SeDebugPrivilege 2108 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
boondocks.exedescription pid process target process PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe PID 4880 wrote to memory of 2108 4880 boondocks.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\boondocks.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\boondocks.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2108-9-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/2108-8-0x0000000077978000-0x0000000077979000-memory.dmpFilesize
4KB
-
memory/2108-11-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2108-13-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2108-14-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4880-0-0x0000000000890000-0x000000000089C000-memory.dmpFilesize
48KB
-
memory/4880-6-0x0000000000560000-0x0000000000562000-memory.dmpFilesize
8KB
-
memory/4880-7-0x0000000076670000-0x00000000766D3000-memory.dmpFilesize
396KB