Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 07:58
Static task
static1
Behavioral task
behavioral1
Sample
786f7116b110303287aed5571dad3789_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
786f7116b110303287aed5571dad3789_JaffaCakes118.exe
-
Size
403KB
-
MD5
786f7116b110303287aed5571dad3789
-
SHA1
1ac724333f61654bb7560721e6420c014bcba932
-
SHA256
704e900ae3d5645795927711e8f35d8b424ffcbbc4535f71346ea0feafebf14a
-
SHA512
5f5f22b55fe1014217fe3a258797c9c77cfca47aa278893eae2cf2ea9037c06df54d9a6a39ff1b3d12d3369b328518ef33da7b1850157c0b0a4c1854f24a88a5
-
SSDEEP
12288:sJixv2zv1grMilAdAYyI2QbWk/NEoQI4shdPYJdBJ:Gi42RlafyIhN/yo9vhuJLJ
Malware Config
Extracted
formbook
4.1
aa3
dorzi.xyz
twentysx.net
myvoteatwork.com
linaje-escogido.com
godgunsncountry.com
bagudangtarung01.net
gemwalljewelry.com
orchidiris.com
opticalucy.com
yoniathome.com
tgg-iris.com
kyjade.com
smtfarming.com
diavacations.com
createkillerproducts.com
mydiscountexpress.com
yangshuotuozhan.com
architecture53seven.com
afitnessdiary.com
baobabusa.com
orgonut.com
dominoperformanceplus.com
greenbanc.info
etop80.com
drramkishorchoudhary.com
ameliyatsizomuztedavisi.com
translationsforyou.com
louiesluncheonette.com
daytradingllc.com
seattleinteriordecorator.com
nordstromcolumbia.com
instateangles.com
ynsteknoloji.xyz
sherepix.info
liwanwu.com
btc631.com
worldofcomicstaan.com
tubingmill.com
yummierpro.com
potatosroleplay.com
louisevictoriafurnishings.com
elitevendo.com
galancadenasabogados.com
kileyjecha.com
xn--80aeingrcwdeeaee.xn--p1acf
therecspot.info
footesfarmsupply.com
vm-partnering.com
westfalen-edelmetalle.com
inspiredearthgoddess.com
passession.club
noodlierry.com
benlolli.com
dickclock.com
fayumei.com
ryukrbajn.icu
haloedge.com
americanmousegoestoitaly.com
bright-cosmetics.com
konzeptware.com
azadari.network
besuper.group
thelostyouthes.com
qqemp.com
chucks3.online
Signatures
-
Formbook payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3040-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/3040-16-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
786f7116b110303287aed5571dad3789_JaffaCakes118.exeRegSvcs.exeNAPSTAT.EXEdescription pid process target process PID 2588 set thread context of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 3040 set thread context of 1196 3040 RegSvcs.exe Explorer.EXE PID 2816 set thread context of 1196 2816 NAPSTAT.EXE Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
786f7116b110303287aed5571dad3789_JaffaCakes118.exeRegSvcs.exeNAPSTAT.EXEpid process 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe 3040 RegSvcs.exe 3040 RegSvcs.exe 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeNAPSTAT.EXEpid process 3040 RegSvcs.exe 3040 RegSvcs.exe 3040 RegSvcs.exe 2816 NAPSTAT.EXE 2816 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
786f7116b110303287aed5571dad3789_JaffaCakes118.exeRegSvcs.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe Token: SeDebugPrivilege 3040 RegSvcs.exe Token: SeDebugPrivilege 2816 NAPSTAT.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
786f7116b110303287aed5571dad3789_JaffaCakes118.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 2588 wrote to memory of 1768 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 1768 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 1768 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 1768 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 1768 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 1768 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 1768 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 2960 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 2960 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 2960 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 2960 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 2960 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 2960 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 2960 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 2588 wrote to memory of 3040 2588 786f7116b110303287aed5571dad3789_JaffaCakes118.exe RegSvcs.exe PID 1196 wrote to memory of 2816 1196 Explorer.EXE NAPSTAT.EXE PID 1196 wrote to memory of 2816 1196 Explorer.EXE NAPSTAT.EXE PID 1196 wrote to memory of 2816 1196 Explorer.EXE NAPSTAT.EXE PID 1196 wrote to memory of 2816 1196 Explorer.EXE NAPSTAT.EXE PID 2816 wrote to memory of 2940 2816 NAPSTAT.EXE cmd.exe PID 2816 wrote to memory of 2940 2816 NAPSTAT.EXE cmd.exe PID 2816 wrote to memory of 2940 2816 NAPSTAT.EXE cmd.exe PID 2816 wrote to memory of 2940 2816 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\786f7116b110303287aed5571dad3789_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\786f7116b110303287aed5571dad3789_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵PID:1768
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵PID:2960
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3040 -
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵PID:2940
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1196-15-0x0000000003980000-0x0000000003A80000-memory.dmpFilesize
1024KB
-
memory/1196-24-0x00000000075D0000-0x0000000007722000-memory.dmpFilesize
1.3MB
-
memory/1196-18-0x00000000075D0000-0x0000000007722000-memory.dmpFilesize
1.3MB
-
memory/2588-1-0x0000000074A10000-0x0000000074FBB000-memory.dmpFilesize
5.7MB
-
memory/2588-2-0x0000000074A10000-0x0000000074FBB000-memory.dmpFilesize
5.7MB
-
memory/2588-3-0x0000000074A10000-0x0000000074FBB000-memory.dmpFilesize
5.7MB
-
memory/2588-4-0x0000000074A10000-0x0000000074FBB000-memory.dmpFilesize
5.7MB
-
memory/2588-0-0x0000000074A11000-0x0000000074A12000-memory.dmpFilesize
4KB
-
memory/2588-12-0x0000000074A10000-0x0000000074FBB000-memory.dmpFilesize
5.7MB
-
memory/2816-21-0x0000000000E40000-0x0000000000E86000-memory.dmpFilesize
280KB
-
memory/2816-19-0x0000000000E40000-0x0000000000E86000-memory.dmpFilesize
280KB
-
memory/3040-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3040-17-0x00000000002B0000-0x00000000002C4000-memory.dmpFilesize
80KB
-
memory/3040-16-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3040-13-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/3040-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3040-8-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3040-5-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB