Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-07-2024 12:55

General

  • Target

    3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe

  • Size

    483KB

  • MD5

    3d76b5c0f9611f01f44c3a74e1aebe69

  • SHA1

    e6c2986ec30242d93d85f47d1a9922d080e00ad2

  • SHA256

    720ffc99aa96c665aae27db46f776476c37ca113db207790579adfd81c73ad05

  • SHA512

    5014ee087f6a4ff56edeb80405e2d4e56928495b6f351ba27805f074c330b4f130b5228d00d31bfcf75102376c98cf643958aca8b1e00acafed0ace16513c39b

  • SSDEEP

    12288:UFda+Fda+EMYLysUN8dR6q5T2ComsZ4UyDZ0dOaAf:UEMkrdRLdho1aJd

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bf3

Decoy

ecatcom.com

what3emoji.com

primbathandbody.com

yt-itclub.com

newbieeer.com

getyoursofa.com

mexicanitems.info

catalogcardgames.net

leagueofwomengolfers.com

gvanmp.com

midnightsunhi.com

cnluma.com

sunsetcherrydesigns.com

cosmoproturkey.com

inifinityapps.net

making50masks.com

battalionice.com

uk-calculation.net

frosteatlove.com

bs-mag.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Beds Protector Packer 1 IoCs

    Detects Beds Protector packer used to load .NET malware.

  • Formbook payload 1 IoCs
  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'
      2⤵
      • Drops startup file
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3928
    • C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\3d76b5c0f9611f01f44c3a74e1aebe69_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_izt3pklp.ksg.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/3928-31-0x0000000006610000-0x000000000662E000-memory.dmp

    Filesize

    120KB

  • memory/3928-35-0x0000000006B50000-0x0000000006B72000-memory.dmp

    Filesize

    136KB

  • memory/3928-34-0x0000000006A40000-0x0000000006A5A000-memory.dmp

    Filesize

    104KB

  • memory/3928-33-0x0000000006AB0000-0x0000000006B46000-memory.dmp

    Filesize

    600KB

  • memory/3928-32-0x0000000006630000-0x000000000667C000-memory.dmp

    Filesize

    304KB

  • memory/3928-39-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3928-24-0x0000000006040000-0x0000000006394000-memory.dmp

    Filesize

    3.3MB

  • memory/3928-19-0x0000000005FD0000-0x0000000006036000-memory.dmp

    Filesize

    408KB

  • memory/3928-9-0x0000000005050000-0x0000000005086000-memory.dmp

    Filesize

    216KB

  • memory/3928-10-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

  • memory/3928-11-0x0000000005720000-0x0000000005D48000-memory.dmp

    Filesize

    6.2MB

  • memory/3928-12-0x0000000005D90000-0x0000000005DB2000-memory.dmp

    Filesize

    136KB

  • memory/3928-18-0x0000000005E30000-0x0000000005E96000-memory.dmp

    Filesize

    408KB

  • memory/4524-28-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/4524-30-0x0000000001440000-0x000000000178A000-memory.dmp

    Filesize

    3.3MB

  • memory/4732-8-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

  • memory/4732-7-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

    Filesize

    4KB

  • memory/4732-25-0x0000000004A20000-0x0000000004A36000-memory.dmp

    Filesize

    88KB

  • memory/4732-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

    Filesize

    4KB

  • memory/4732-29-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

  • memory/4732-6-0x0000000004BA0000-0x0000000004C3C000-memory.dmp

    Filesize

    624KB

  • memory/4732-5-0x00000000024E0000-0x0000000002544000-memory.dmp

    Filesize

    400KB

  • memory/4732-3-0x0000000074C10000-0x00000000753C0000-memory.dmp

    Filesize

    7.7MB

  • memory/4732-4-0x0000000004A30000-0x0000000004AC2000-memory.dmp

    Filesize

    584KB

  • memory/4732-2-0x00000000050B0000-0x0000000005654000-memory.dmp

    Filesize

    5.6MB

  • memory/4732-1-0x00000000000C0000-0x0000000000140000-memory.dmp

    Filesize

    512KB