Overview
overview
10Static
static
3863bf0dfa1...18.exe
windows7-x64
10863bf0dfa1...18.exe
windows10-2004-x64
10$APPDATA/f...60.dll
windows7-x64
1$APPDATA/f...60.dll
windows10-2004-x64
1$APPDATA/f...xy.exe
windows7-x64
1$APPDATA/f...xy.exe
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$TEMP/2006...60.dll
windows7-x64
1$TEMP/2006...60.dll
windows10-2004-x64
1$TEMP/Situ...le.dll
windows7-x64
1$TEMP/Situ...le.dll
windows10-2004-x64
10$TEMP/mode...ap.dll
windows7-x64
1$TEMP/mode...ap.dll
windows10-2004-x64
1$TEMP/mode...UI.dll
windows7-x64
1$TEMP/mode...UI.dll
windows10-2004-x64
1$TEMP/mode...UI.dll
windows7-x64
1$TEMP/mode...UI.dll
windows10-2004-x64
1$TEMP/mode...lc.exe
windows7-x64
1$TEMP/mode...lc.exe
windows10-2004-x64
1$TEMP/mode...or.dll
windows7-x64
1$TEMP/mode...or.dll
windows10-2004-x64
1Analysis
- max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
31/05/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$APPDATA/for/page_1/13.opends60.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$APPDATA/for/page_1/13.opends60.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$TEMP/2006/35.opends60.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
$TEMP/2006/35.opends60.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$TEMP/SitulaCystocele.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral14
Sample
$TEMP/SitulaCystocele.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/mode/Thumbs.db/intern/PermCalc.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/mode/Thumbs.db/intern/PermCalc.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral24
Sample
$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target 863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe
- Size 395KB
- Sample240531-hhlbhsbb66
- SHA256 a102b644fd134778f28e1105e4645e84ff4d05687351990de90ae27a89f0513b
- MD5 863bf0dfa1169706f566c070a1e11256
- SHA1 77175726680e40eeefdad0578a1d3377486d9fff
- SHA512 21aef52bb4b5ed66c632c0ca55e156b95dd5bf2715599880fb0b5ffea523fca0b82739cf2617095336c332664ab8dcdd64fa910d3bae64c9f384767709720ada
- SSDEEP 12288:nanOzOlC9Am80quPgdBHh/FOPfe+VYRVORkG:lqltm80qigrHxFGVYbi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
formbook
-
4.1
-
c232
-
tangdourenfz.com
-
helpforkids.today
-
bioethanol-us.com
-
0351zc.com
-
3rdimultimedia.com
-
thecannibisconnection.net
-
mktoob.net
-
orchidinvestmentlimited.com
-
moccustoms.com
-
shopendora.com
-
rosariosandino.com
-
bien-vivre-tunisie.com
-
godofgreens.com
-
nhathuocphuongle.com
-
thefastsource.com
-
viagra2tadalafil.com
-
abarroteslacanasta.com
-
versabiosciences.com
-
nergiztarimhayvancilik.com
-
airpodsbayi.com
-
fitnessdan.com
-
passionunipessoal.com
-
spl.energy
-
review-id9326.com
-
studystudy.xyz
-
syringacio.com
-
beensentoe.com
-
pasforon.com
-
omegagyn.com
-
yourmassagewellness.com
-
develop-er.com
-
biosqualene.com
-
smartlocalizer.com
-
impotsgovparticulier.digital
-
primponabarbie.world
-
energy-x.site
-
tatlerstyle.com
-
shucaiw.pro
-
kita-minimum.com
-
nirvanatopshelf.com
-
thefrontrangedeals.com
-
cbaenterpriseaccount.com
-
antalyadissagligi.com
-
drivewalkbike.com
-
learn2pop.com
-
suzhoukelida.com
-
alloutthere.com
-
cle-ar.com
-
ditaaulia.online
-
solarpowermate.com
-
amazon-account-service-webs.com
-
7jonquilcourt.com
-
beautyart-marrakech.com
-
asaany.com
-
barinetportal.com
-
benbernardfilms.com
-
mousepays.com
-
insidethelooppodcast.com
-
seatedworkouts.com
-
ketch-mania.com
-
qingfuhall.com
-
euphoricempress.com
-
veomtreadmillexpert.com
-
bigboltbooks.com
-
dokap.xyz
Signatures
- Formbook payload 2 IoCs
resource yara_rule behavioral2/memory/1752-27-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/1752-30-0x0000000000400000-0x000000000042E000-memory.dmp formbook - Loads dropped DLL 1 IoCs
pid Process 4916 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DVOXOR5PER = "C:\\Program Files (x86)\\Jdv10s4l\\taskhost2d3.exe" help.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1752 set thread context of 3560 1752 cmd.exe 56 PID 3212 set thread context of 3560 3212 help.exe 56 - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Jdv10s4l\taskhost2d3.exe help.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \Registry\User\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 4916 rundll32.exe 1752 cmd.exe 1752 cmd.exe 1752 cmd.exe 1752 cmd.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 4916 rundll32.exe 1752 cmd.exe 1752 cmd.exe 1752 cmd.exe 3212 help.exe 3212 help.exe 3212 help.exe 3212 help.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1752 cmd.exe Token: SeDebugPrivilege 3212 help.exe Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE Token: SeShutdownPrivilege 3560 Explorer.EXE Token: SeCreatePagefilePrivilege 3560 Explorer.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 4916 4408 863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe 80 PID 4408 wrote to memory of 4916 4408 863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe 80 PID 4408 wrote to memory of 4916 4408 863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe 80 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81 PID 4916 wrote to memory of 1752 4916 rundll32.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe SitulaCystocele,Hurley3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3212 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:2280
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:2252
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1812
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DB1
- Size 46KB
- SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
- MD5 8f5942354d3809f865f9767eddf51314
- SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
- SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
- SSDEEP 96:FSXNKLyeymwHCn8MouOFlRGiZqYtFTCG:FSfHG7qqifTCG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Prosody
- Size 231KB
- SHA256 27c010483a5665042dd6c20c69f9fdc4bbe9f7bf7fcc516f51cc8318a8c3b844
- MD5 6847287ec5adf184583fac09b774e5dd
- SHA1 52183c47dd439a5695eee05e2f22608e32179427
- SHA512 1e7dbf36ac5949e120f804ebd986882e7d66ce1dc3bd8d0888073ea2f3f07fc13d8d11669372822d3630caf299a1675fd9cf62891203d67b8685520ff3d2775d
- SSDEEP 3072:qUHfey9EV+nU39H7PbC2Rj7vsWPXPAEBnRh+cKKAZlVzY11BtYQuPf8h8d16D6RW:flEcyR7iEBRheltYPPOPf++bKiYR2s
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\SitulaCystocele.DLL
- Size 50KB
- SHA256 18e86106e60613594527c85fe6c97287fc8c3715181a62cb2b4d2258c210b6c8
- MD5 de3f3ceccff80b3b0cc7e8cc58357b70
- SHA1 701387d5e62903e114f4bdf59cd4f89cc6b2ad4e
- SHA512 ad16ea6af2200f7f8a8c0fd0cc1fe5c935942a8789ce057818499b1a51865bb4a0b39a4091f84a2652d2c6ea7569e3829dd5b3043b2d44083a597f3954c2c6db
- SSDEEP 1536:5EOuTAjdpOExDJANAB/qepudoVoD3Qu3IEN:5yA/DJ3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\74-76ATE\74-logim.jpeg
- Size 84KB
- SHA256 ebace1114d141369036c1748a460288135178bab93ac580aacf9dde66689a4a5
- MD5 c24840b28ab8bba62e163fb29224b9cb
- SHA1 593e7dc6dd26f2ee061fd41506554dca66449a06
- SHA512 1e82c3f466c2ce9bb3a81012e12e33bf4352d0040c82322ea843ee8ec8d67422b16117ce2a5fb0aa47be8ef5670bad9c5a4dfb219cd504bc646dc1d6a436d5dc
- SSDEEP 1536:soaUuZ46zUdNpz+/jkjQYtmb78Ja1DPZXwnBxqrctUJaG:AARdOmtmbgJa1DPZAnBU++
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\74-76ATE\74-logrf.ini
- Size 40B
- SHA256 1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361
- MD5 2f245469795b865bdd1b956c23d7893d
- SHA1 6ad80b974d3808f5a20ea1e766c7d2f88b9e5895
- SHA512 909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\74-76ATE\74-logrg.ini
- Size 38B
- SHA256 75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56
- MD5 4aadf49fed30e4c9b3fe4a3dd6445ebe
- SHA1 1e332822167c6f351b99615eada2c30a538ff037
- SHA512 eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\74-76ATE\74-logri.ini
- Size 40B
- SHA256 eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae
- MD5 d63a82e5d81e02e399090af26db0b9cb
- SHA1 91d0014c8f54743bba141fd60c9d963f869d76c9
- SHA512 38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\74-76ATE\74-logrv.ini
- Size 872B
- SHA256 ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb
- MD5 bbc41c78bae6c71e63cb544a6a284d94
- SHA1 33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a
- SHA512 0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4
- MD5 SHA1 SHA512