Analysis
- max time kernel
94s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
13/07/2024, 18:39
General
- Target 42e06d3213f0d6aa88948aae99165f2b_JaffaCakes118.exe
- Size 982KB
- Sample240713-xa2qvsvcrb
- SHA256 7ffcfe208773bc49ef7a0e832fe117592b8eaf83484ebc9cfe9c64eb354aadec
Malware Config
Extracted
-
formbook
-
4.1
-
t052
-
ladybug-learning.com
-
unforgottenstory.com
-
oldmopaiv.xyz
-
natashaexim.com
-
hannahmcelgunn.com
-
retargetingmachines.info
-
njoconline.com
-
unicornlankadelivery.com
-
giftkerala.com
-
englishfordoctors.online
-
schatzilandrvresort.com
-
brujoisaac.com
-
basiccampinggear.com
-
escapees.today
-
dgyxsy888.com
-
stevebana.xyz
-
mimozakebap.com
-
ezdoff.com
-
pluumyspalace.com
-
shaoshanshan.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42e06d3213f0d6aa88948aae99165f2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42e06d3213f0d6aa88948aae99165f2b_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\42e06d3213f0d6aa88948aae99165f2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42e06d3213f0d6aa88948aae99165f2b_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\42e06d3213f0d6aa88948aae99165f2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\42e06d3213f0d6aa88948aae99165f2b_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2280-12-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2280-15-0x00000000013C0000-0x000000000170A000-memory.dmp
memory/2720-6-0x0000000005B30000-0x0000000005B86000-memory.dmp
memory/2720-3-0x0000000005FA0000-0x0000000006544000-memory.dmp
memory/2720-4-0x0000000005A90000-0x0000000005B22000-memory.dmp
memory/2720-5-0x00000000059F0000-0x00000000059FA000-memory.dmp
memory/2720-0-0x000000007468E000-0x000000007468F000-memory.dmp
memory/2720-7-0x0000000074680000-0x0000000074E30000-memory.dmp
memory/2720-8-0x0000000005D30000-0x0000000005D3A000-memory.dmp
memory/2720-9-0x000000007468E000-0x000000007468F000-memory.dmp
memory/2720-10-0x0000000074680000-0x0000000074E30000-memory.dmp
memory/2720-11-0x0000000001940000-0x00000000019A2000-memory.dmp
memory/2720-2-0x0000000005950000-0x00000000059EC000-memory.dmp
memory/2720-14-0x0000000074680000-0x0000000074E30000-memory.dmp
memory/2720-1-0x0000000000EA0000-0x0000000000F9A000-memory.dmp