Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10/06/2024, 14:09
General
-
Target
9aed70a63a9b5ba11bd1f44177f1a1ad_JaffaCakes118.exe
-
Size
284KB
-
MD5
9aed70a63a9b5ba11bd1f44177f1a1ad
-
SHA1
3dcd99b61503cc69cdcddeb783f746da5f167edb
-
SHA256
fa580f04db69517d1b9f7f9e1d88367e89645f90d8eb0698c4793389d3aabda8
-
SHA512
2d9edf0d7f5ccdebf27690a5269a87334cbe8d64a676e9b3ee23c191cf3449387446c7968cbfa53a8bc16d3becc5395a1b370a6e633c35e2dbdddc03909f110c
-
SSDEEP
3072:VuH0Vy0up0NMjbcORKCwNETwoWqcFysVKHxnIZJpS9eqsqcD4JoMf:EHmy0dNMjQDCwNETw359axnIZb6sMJh
Malware Config
Extracted
formbook
3.8
css
fnxmedia.com
joakimnoahonline.com
prorokers.net
otfego.info
lucao20201.com
1q4y6.info
carefullyhandmade.com
walktalkbaby.com
carpetcanvas.win
boyzpro.com
the-one-wave.com
cbd-oil.online
uiiuii.net
securitycameraadvisor.com
phillipsfarmstead.com
vssuq.info
huasitee.com
bitandbreakfast.com
poiuyt.info
haterstyle.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aed70a63a9b5ba11bd1f44177f1a1ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9aed70a63a9b5ba11bd1f44177f1a1ad_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
Filesize
856KB
-
Filesize
1.1MB
-
Filesize
3.0MB
-
Filesize
3.0MB