Analysis

  • max time kernel
    136s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 20:02

General

  • Target

    43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe

  • Size

    501KB

  • MD5

    43251b851d7807ea3a8a31aa1945a376

  • SHA1

    d7972a48974b7b00f7a0b0866107690a04b65a26

  • SHA256

    d7433ec981297919971fcf1e7017b9d8169a787a2f24aa2c31f08500ee510057

  • SHA512

    1d61cb1b95556f7e9cb7ece2e5b4616b38769c0b1ef09751f2797e943a5c0befcd752a5cecf302399248dfa6ed4b065dce33c563b2b73e4e63f830c2fc941665

  • SSDEEP

    6144:wBFXjwC6hJTY7Vy41qmntOc25C/+O9aAE48EBrz4o1T4K+oRlPNUaAYJl/fO9ks:CRz6hG7VTxQr4DLnRlP6qr

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ktz

Decoy

healthbeautysublime.com

simplysouthcarolina.com

lunarsuncreations.com

madhurbazar.website

bestsellersecret.com

geniusbytesdemo.com

timetodebate.com

sarkariresult.network

k-kard.com

selagiprojects.com

sidechickrecords.net

pattayamoneyexchange.com

cindykeet.com

writefordelight.com

1to2rooms.com

doubi2.com

kairospromotions.com

emergencyresponsetech.com

purbelipana.com

reimaginingdental.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe"
      2⤵
        PID:3752
      • C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\43251b851d7807ea3a8a31aa1945a376_JaffaCakes118.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4160

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3040-6-0x0000000005A90000-0x0000000005AE6000-memory.dmp

      Filesize

      344KB

    • memory/3040-8-0x0000000005B10000-0x0000000005B1A000-memory.dmp

      Filesize

      40KB

    • memory/3040-2-0x0000000005780000-0x000000000581C000-memory.dmp

      Filesize

      624KB

    • memory/3040-3-0x0000000005E10000-0x00000000063B4000-memory.dmp

      Filesize

      5.6MB

    • memory/3040-4-0x0000000005900000-0x0000000005992000-memory.dmp

      Filesize

      584KB

    • memory/3040-5-0x0000000005820000-0x000000000582A000-memory.dmp

      Filesize

      40KB

    • memory/3040-1-0x0000000000D40000-0x0000000000DC4000-memory.dmp

      Filesize

      528KB

    • memory/3040-7-0x0000000074710000-0x0000000074EC0000-memory.dmp

      Filesize

      7.7MB

    • memory/3040-0-0x000000007471E000-0x000000007471F000-memory.dmp

      Filesize

      4KB

    • memory/3040-9-0x000000007471E000-0x000000007471F000-memory.dmp

      Filesize

      4KB

    • memory/3040-10-0x0000000074710000-0x0000000074EC0000-memory.dmp

      Filesize

      7.7MB

    • memory/3040-11-0x0000000001430000-0x000000000148C000-memory.dmp

      Filesize

      368KB

    • memory/3040-14-0x0000000074710000-0x0000000074EC0000-memory.dmp

      Filesize

      7.7MB

    • memory/4160-12-0x0000000000400000-0x000000000042E000-memory.dmp

      Filesize

      184KB

    • memory/4160-15-0x00000000016D0000-0x0000000001A1A000-memory.dmp

      Filesize

      3.3MB