Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 15:48
Static task
static1
Behavioral task
behavioral1
Sample
3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe
-
Size
906KB
-
MD5
3dfdc72a69e464e2fe5a9dc15d0f872c
-
SHA1
9cdb47a1b52762d9a94be067d0542c1e1fb7ee91
-
SHA256
d9d91e187b55cc521e8d3c79ac49d8bdd771a5626c2d39a7d788c97234248a19
-
SHA512
d7567c0a206fdbc0776632b7d675ad9079a75160296848b20de04f39ff472129603f818129b48a3e76e7bd57a141dfec215eb77bba530102e1c247f75f003f4f
-
SSDEEP
12288:23RDRcAqZi970Oz6hGEM7CT3GddRdiKityWfxdXbeASgn16Nf5/ltloLtt1eWYLK:3Z3sS2Pi7X3d6f59G
Malware Config
Extracted
formbook
4.1
2kf
edmondscakes.com
doublewldr.online
tickets2usa.com
heyhxry.com
weightloss-gulfport.com
prosselius.com
newviewroofers.com
jacksonarearealestate.com
catparkas.xyz
pagos2020.com
sonwsefjrahi.online
franchisethings.com
nuocvietngaynay.com
sohelvai.com
mikeyroush.com
lamesaroofing.com
betbigo138.com
amazon-service-recovery.com
clockin.net
riostrader.com
novergi.com
bounethone.online
unsaluted-muckworm.info
qmglg.com
trans-chna.com
bloom-cottage.info
espacioholista.com
vitrines72.com
vtnywveb.club
shelfdryrock.com
lowcountrykindermusik.com
brendolangiovanni.com
samilisback.com
coffeeofmyheart.com
moderndetailist.com
royalparkhotelandsuites.com
camsick.com
khoetuthiennhien.com
link-glue.com
zzirk.com
alyxthorne.com
tristateinsurancegroup.com
pdztwl.com
basecampmedics.com
orionbilisim.net
comaholic.com
sai-re.com
mimmodetullio.net
thevyvd.com
bookstorie.com
preparednessnow.net
lvtvmounting.com
anchondowedding.com
the-florida-accident-md.com
indyspirits.com
culture-of-safety.com
blue-003.com
federation-advens.com
junmedicare.com
qjnhilfhs.icu
chesed72.com
kingrvrentals.com
greenlightsuccesscoach.com
efrenjose.com
midnightblueinc.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/988-17-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exedescription pid process target process PID 1508 set thread context of 988 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exepid process 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 988 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 988 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exedescription pid process target process PID 1508 wrote to memory of 4824 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe schtasks.exe PID 1508 wrote to memory of 4824 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe schtasks.exe PID 1508 wrote to memory of 4824 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe schtasks.exe PID 1508 wrote to memory of 988 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe PID 1508 wrote to memory of 988 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe PID 1508 wrote to memory of 988 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe PID 1508 wrote to memory of 988 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe PID 1508 wrote to memory of 988 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe PID 1508 wrote to memory of 988 1508 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe 3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZvKfYNN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5E0.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3dfdc72a69e464e2fe5a9dc15d0f872c_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59766110cfa6062cac654f6de27c292f5
SHA19b402115d34f9ba3e878dfe7afac4329676422c1
SHA256d68c1d2c39bfb298865d6a738b6f1aa8aef1946c01ae3b0c2730e2686f8bab07
SHA51273f2895010f64605ace90865b0744e6b47977da572d563663a3997ceff00b7ac357fe7d8dc982d9c1419c3d59bd0f995f734a7b754de475e71ab0303d64922f3