Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
26/05/2024, 09:45
General
- Target 75139da89b79d88a8d5f2f527446ecee_JaffaCakes118.exe
- Size 419KB
- Sample240526-lrfdeaea61
- SHA256 dfa4a44e0f63c067e406e37c7b8915ac728ce6ecc1d13cf280de7064861dd872
Malware Config
Extracted
-
formbook
-
4.1
-
o9bs
-
akasa.technology
-
necruzrecords.com
-
funyr.com
-
granny-mask.com
-
videoqr.net
-
grancanariastagandhen.com
-
bournesolutionsgroup.com
-
car-shop-kenken.com
-
2zd8dn5t-mn4.com
-
a-nakameguro.com
-
gtl.systems
-
baizhan180.xyz
-
tnawxilv.com
-
dcdhoom.com
-
dalaman.website
-
shopredsea.com
-
rockbrookcapitalholdings.com
-
carguyla.com
-
adpservice.net
-
freecodecast.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75139da89b79d88a8d5f2f527446ecee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75139da89b79d88a8d5f2f527446ecee_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zxNuTESeEf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp538A.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\75139da89b79d88a8d5f2f527446ecee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75139da89b79d88a8d5f2f527446ecee_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\75139da89b79d88a8d5f2f527446ecee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75139da89b79d88a8d5f2f527446ecee_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp538A.tmp
memory/3252-8-0x0000000004FA0000-0x0000000004FAA000-memory.dmp
memory/3252-10-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/3252-3-0x0000000007F70000-0x0000000008514000-memory.dmp
memory/3252-4-0x0000000007A60000-0x0000000007AF2000-memory.dmp
memory/3252-5-0x0000000004F80000-0x0000000004F8A000-memory.dmp
memory/3252-6-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/3252-2-0x0000000007920000-0x00000000079BC000-memory.dmp
memory/3252-7-0x0000000007BF0000-0x0000000007C46000-memory.dmp
memory/3252-9-0x0000000074E6E000-0x0000000074E6F000-memory.dmp
memory/3252-0-0x0000000074E6E000-0x0000000074E6F000-memory.dmp
memory/3252-11-0x00000000086F0000-0x0000000008746000-memory.dmp
memory/3252-12-0x0000000008740000-0x0000000008776000-memory.dmp
memory/3252-1-0x0000000000A60000-0x0000000000AD0000-memory.dmp
memory/3252-20-0x0000000074E60000-0x0000000075610000-memory.dmp
memory/5068-18-0x0000000000400000-0x000000000042E000-memory.dmp
memory/5068-21-0x0000000001240000-0x000000000158A000-memory.dmp