Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12-07-2024 02:39

General

  • Target

    3bb1bed04b14c0cb63dbf910a5bc3528_JaffaCakes118.exe

  • Size

    688KB

  • MD5

    3bb1bed04b14c0cb63dbf910a5bc3528

  • SHA1

    afc97fc9cef9357f783e45489f0125ddd66fa52b

  • SHA256

    66699c8f4a4f0be5c62dc4b76a719babf30cd88a0716b575ad56fd0070753c7c

  • SHA512

    74f5d51679e0ad701a765fbdf93bf7cccf995f804b134ca8fceee6ce95358d8a69943f8c840b401030597480e1192b5e9dde3f2bc15a0dc5e32e139ab1915d25

  • SSDEEP

    12288:6Zi9709qhxAySXmt5h/mgEgQgkiQ8inucai4mE3UhDpV0qZ7AYuCBm:6Z2Ahmb5rE9mqOA1yk7AYuR

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xle

Decoy

tknbr.com

loyaloneconstruction.com

what-where.com

matebacapital.com

marriedandmore.com

qiemfsolutions.com

graececonsulting.com

www7456.com

littlefreecherokeelibrary.com

tailgatepawkinglot.com

musheet.com

tesfamariamtb.com

1728025.com

xceltechuae.com

harperandchloe.com

thepamperedbarber.com

5050alberta.com

supplychainstrainer.com

lacorte.group

ringingbear.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bb1bed04b14c0cb63dbf910a5bc3528_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3bb1bed04b14c0cb63dbf910a5bc3528_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\3bb1bed04b14c0cb63dbf910a5bc3528_JaffaCakes118.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1292-6-0x0000000004D90000-0x0000000004E14000-memory.dmp

    Filesize

    528KB

  • memory/1292-1-0x0000000000320000-0x00000000003D2000-memory.dmp

    Filesize

    712KB

  • memory/1292-2-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/1292-3-0x0000000000220000-0x000000000022A000-memory.dmp

    Filesize

    40KB

  • memory/1292-4-0x00000000744DE000-0x00000000744DF000-memory.dmp

    Filesize

    4KB

  • memory/1292-5-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/1292-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

    Filesize

    4KB

  • memory/1292-14-0x00000000744D0000-0x0000000074BBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2680-8-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2680-13-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2680-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2680-9-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2680-15-0x00000000009A0000-0x0000000000CA3000-memory.dmp

    Filesize

    3.0MB