Analysis

  • max time kernel
    35s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    12-07-2024 12:55

General

  • Target

    3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe

  • Size

    483KB

  • MD5

    3d76b5c0f9611f01f44c3a74e1aebe69

  • SHA1

    e6c2986ec30242d93d85f47d1a9922d080e00ad2

  • SHA256

    720ffc99aa96c665aae27db46f776476c37ca113db207790579adfd81c73ad05

  • SHA512

    5014ee087f6a4ff56edeb80405e2d4e56928495b6f351ba27805f074c330b4f130b5228d00d31bfcf75102376c98cf643958aca8b1e00acafed0ace16513c39b

  • SSDEEP

    12288:UFda+Fda+EMYLysUN8dR6q5T2ComsZ4UyDZ0dOaAf:UEMkrdRLdho1aJd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bf3

Decoy

ecatcom.com

what3emoji.com

primbathandbody.com

yt-itclub.com

newbieeer.com

getyoursofa.com

mexicanitems.info

catalogcardgames.net

leagueofwomengolfers.com

gvanmp.com

midnightsunhi.com

cnluma.com

sunsetcherrydesigns.com

cosmoproturkey.com

inifinityapps.net

making50masks.com

battalionice.com

uk-calculation.net

frosteatlove.com

bs-mag.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Beds Protector Packer 1 IoCs

    Detects Beds Protector packer used to load .NET malware.

  • Formbook payload 1 IoCs
  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'
      2⤵
      • Drops startup file
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2776
    • C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2012-0-0x00000000749AE000-0x00000000749AF000-memory.dmp

    Filesize

    4KB

  • memory/2012-1-0x0000000000190000-0x0000000000210000-memory.dmp

    Filesize

    512KB

  • memory/2012-2-0x00000000749A0000-0x000000007508E000-memory.dmp

    Filesize

    6.9MB

  • memory/2012-3-0x0000000000BE0000-0x0000000000C44000-memory.dmp

    Filesize

    400KB

  • memory/2012-4-0x00000000749AE000-0x00000000749AF000-memory.dmp

    Filesize

    4KB

  • memory/2012-5-0x00000000749A0000-0x000000007508E000-memory.dmp

    Filesize

    6.9MB

  • memory/2012-20-0x00000000749A0000-0x000000007508E000-memory.dmp

    Filesize

    6.9MB

  • memory/2012-12-0x00000000003A0000-0x00000000003B6000-memory.dmp

    Filesize

    88KB

  • memory/2776-10-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2776-11-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2776-9-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2776-8-0x000000006F7E1000-0x000000006F7E2000-memory.dmp

    Filesize

    4KB

  • memory/2776-18-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

    Filesize

    5.7MB

  • memory/2776-23-0x000000006F7E0000-0x000000006FD8B000-memory.dmp

    Filesize

    5.7MB

  • memory/3000-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3000-14-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3000-13-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3000-19-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3000-21-0x0000000000980000-0x0000000000C83000-memory.dmp

    Filesize

    3.0MB