Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 20:02
Static task
static1
Behavioral task
behavioral1
Sample
43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe
-
Size
501KB
-
MD5
43251b851d7807ea3a8a31aa1945a376
-
SHA1
d7972a48974b7b00f7a0b0866107690a04b65a26
-
SHA256
d7433ec981297919971fcf1e7017b9d8169a787a2f24aa2c31f08500ee510057
-
SHA512
1d61cb1b95556f7e9cb7ece2e5b4616b38769c0b1ef09751f2797e943a5c0befcd752a5cecf302399248dfa6ed4b065dce33c563b2b73e4e63f830c2fc941665
-
SSDEEP
6144:wBFXjwC6hJTY7Vy41qmntOc25C/+O9aAE48EBrz4o1T4K+oRlPNUaAYJl/fO9ks:CRz6hG7VTxQr4DLnRlP6qr
Malware Config
Extracted
formbook
4.1
ktz
healthbeautysublime.com
simplysouthcarolina.com
lunarsuncreations.com
madhurbazar.website
bestsellersecret.com
geniusbytesdemo.com
timetodebate.com
sarkariresult.network
k-kard.com
selagiprojects.com
sidechickrecords.net
pattayamoneyexchange.com
cindykeet.com
writefordelight.com
1to2rooms.com
doubi2.com
kairospromotions.com
emergencyresponsetech.com
purbelipana.com
reimaginingdental.com
plastictown.com
richmen.digital
cerkezkoyuygunsigorta.com
smartreals.com
bigbbqbox.com
ginasiodoempreendedor.com
airportroyalcabservice.com
szxc.ltd
paquitotransportationllc.com
spb2011.com
bfarmproduct.com
deeparchiveweb.com
pj-asphalt-paving.com
hbgydx.com
airpiewindpudding.com
ieltshk.com
pkvmenangqq.com
calaveradayofthedeadjewelry.com
mwfbd.com
bookishjewelry.com
pureaquacarpetcare.com
neonexmd.com
inventneon.icu
shipboxy.com
createdesign-th.com
departurebread.guru
diginetware.com
365reasonsiloveyouriya.com
billionaireblinggg.com
sremi-mckenna-embezzlement.com
yeasuc.com
lovetalks.info
internationalacc.net
integral-commodities.net
fundacja-worklifebalance.com
customsintel.com
ebeletate.com
natashadiamondproperties.com
kincheloeclinic.com
legacy-tc.com
420-organicfields.com
aosi.group
cvc202.com
autheadrens.info
savemoneybewell.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3056-11-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exedescription pid process target process PID 1904 set thread context of 3056 1904 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exepid process 3056 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exedescription pid process target process PID 1904 wrote to memory of 3056 1904 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe PID 1904 wrote to memory of 3056 1904 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe PID 1904 wrote to memory of 3056 1904 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe PID 1904 wrote to memory of 3056 1904 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe PID 1904 wrote to memory of 3056 1904 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe PID 1904 wrote to memory of 3056 1904 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe PID 1904 wrote to memory of 3056 1904 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe 43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3056